auth: no rate limiting on authentication failures #7

Closed
opened 2026-05-14 08:44:12 +00:00 by mathias · 1 comment
Owner

BearerMiddleware returns 401 immediately on failure with no throttling. An attacker can enumerate static tokens or probe for timing differences between JWT and static-token checks without any friction.

File: internal/auth/bearer.go:22-42

Suggestions:

  • Add per-IP failure rate limiting (e.g. 10 failures/min with exponential backoff) in the middleware
  • Add a short fixed-duration sleep on failure path to blunt timing-based token enumeration
  • Return Retry-After header when rate limit is hit
`BearerMiddleware` returns 401 immediately on failure with no throttling. An attacker can enumerate static tokens or probe for timing differences between JWT and static-token checks without any friction. **File:** `internal/auth/bearer.go:22-42` **Suggestions:** - Add per-IP failure rate limiting (e.g. 10 failures/min with exponential backoff) in the middleware - Add a short fixed-duration sleep on failure path to blunt timing-based token enumeration - Return `Retry-After` header when rate limit is hit
Author
Owner

Mis-located. BearerMiddleware (cited internal/auth/bearer.go:22-42) moved to the shared mcp-chassis module in 658f4ba (auth/bearer.go). The unthrottled fall-through 401 is there, not in this repo. Since the middleware is shared by every MCP, the fix belongs in chassis.

Refiled with accurate citations + the shared-lib design constraints (proxy-IP extraction, bounded state, opt-in) and a note that it overlaps the 503 work deferred from #6: mcp-chassis#2.

Recommend closing this as moved → mcp-chassis#2.

Mis-located. `BearerMiddleware` (cited `internal/auth/bearer.go:22-42`) moved to the shared `mcp-chassis` module in `658f4ba` (`auth/bearer.go`). The unthrottled fall-through 401 is there, not in this repo. Since the middleware is shared by every MCP, the fix belongs in chassis. Refiled with accurate citations + the shared-lib design constraints (proxy-IP extraction, bounded state, opt-in) and a note that it overlaps the 503 work deferred from #6: **mcp-chassis#2**. Recommend closing this as moved → mcp-chassis#2.
Sign in to join this conversation.
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mathias/gitea-mcp#7