ingestion metrics: an authenticated request to an unregistered path is labelled with the raw URL path (unbounded series) #185

New Issue

2026-10-05T14:28:57Z

mathias commented

2026-10-05 14:28:57 +00:00

Source: PR #181 review (comment 15483, non-blocking).

An authenticated REST request to an unregistered path reaches the inner REST mux. The mux returns 404 and leaves r.Pattern empty, and metrics.Middleware then falls back to the raw r.URL.Path. So any token holder can create one Prometheus series per unique path.

Refused requests are bounded: labelRESTPattern (ingestion/cmd/server/routes.go) keeps them at "/". This gap is older than PR #181. The reviewer measured the same label set on main and on 474473c across 1,872 requests. #181 corrects the doc comment, which had claimed the problem was solved.

Done when: a request with an empty Pattern gets a fixed catch-all label (e.g. "/" or "unmatched") instead of the raw path, and a test sends an authenticated request to a random path and asserts that the random segment does not appear in /metrics.

Created via git-mcp on behalf of @mathias

Source: PR #181 review (comment 15483, non-blocking). An **authenticated** REST request to an unregistered path reaches the inner REST mux. The mux returns 404 and leaves `r.Pattern` empty, and `metrics.Middleware` then falls back to the raw `r.URL.Path`. So any token holder can create one Prometheus series per unique path. Refused requests are bounded: `labelRESTPattern` (`ingestion/cmd/server/routes.go`) keeps them at `"/"`. This gap is older than PR #181. The reviewer measured the same label set on main and on 474473c across 1,872 requests. #181 corrects the doc comment, which had claimed the problem was solved. **Done when:** a request with an empty Pattern gets a fixed catch-all label (e.g. `"/"` or `"unmatched"`) instead of the raw path, and a test sends an authenticated request to a random path and asserts that the random segment does not appear in `/metrics`. --- _Created via git-mcp on behalf of @mathias_

mathias referenced this issue

2026-10-05 14:31:22 +00:00

fix(ingestion): bump mcp-chassis to v0.7.1; label refused REST requests by route (#155) #181

mathias referenced this issue

2026-10-05 14:41:11 +00:00

ingestion pins mcp-chassis v0.2.0: auth rejections aren't logged; REST metrics collapse to path="/" #155

mathias referenced this issue from a commit

2026-10-05 21:42:48 +00:00

fix(metrics): label an unmatched request "unmatched", never its raw path (#185)

mathias closed this issue

2026-10-05 21:42:48 +00:00

Sign in to join this conversation.