CRITICAL: Rate limiting completely disabled (all decorators are no-op stubs) #35

New issue

Closed

opened 2026-05-09 05:18:36 +00:00 by Mark · 2 comments

Mark commented

2026-05-09 05:18:36 +00:00

Owner

Severity: Critical

Description

The rate limiting middleware (slowapi) is initialized, but all rate_limit_* decorator functions in backend/app/rate_limit.py (lines 52-94) are no-op stubs that do nothing. They all return a noop function that performs no rate limiting.

def rate_limit_auth():
    """Rate limit for authentication endpoints - temporarily disabled."""
    def noop(*args, **kwargs):
        return noop
    return noop

This means:

Auth endpoints have NO brute-force protection
Evidence gathering endpoints have NO abuse prevention
Heavy OSINT operations have NO rate limiting

Impact

An attacker can:

Bruteforce login credentials with unlimited attempts
Flood the system with evidence gathering tasks
Exhaust API rate limits on external services
Denial-of-service via Celery task queue flooding

Recommendation

Remove the "temporarily disabled" comment and implement actual rate limits
At minimum, apply rate limiting to /api/auth/token (login endpoint)
Use different limits for read vs write vs heavy operations

## Severity: Critical ## Description The rate limiting middleware (`slowapi`) is initialized, but all `rate_limit_*` decorator functions in `backend/app/rate_limit.py` (lines 52-94) are **no-op stubs** that do nothing. They all return a `noop` function that performs no rate limiting. ```python def rate_limit_auth(): """Rate limit for authentication endpoints - temporarily disabled.""" def noop(*args, **kwargs): return noop return noop ``` This means: - Auth endpoints have NO brute-force protection - Evidence gathering endpoints have NO abuse prevention - Heavy OSINT operations have NO rate limiting ## Impact An attacker can: 1. Bruteforce login credentials with unlimited attempts 2. Flood the system with evidence gathering tasks 3. Exhaust API rate limits on external services 4. Denial-of-service via Celery task queue flooding ## Recommendation 1. Remove the "temporarily disabled" comment and implement actual rate limits 2. At minimum, apply rate limiting to `/api/auth/token` (login endpoint) 3. Use different limits for read vs write vs heavy operations

Mark added the

feature-request

label

2026-05-11 20:13:55 +00:00

Mark added the

triage-approved

label

2026-05-12 23:53:26 +00:00

Mark commented

2026-05-13 23:53:13 +00:00

Author

Owner

Triage decision: Approved as bug (critical).

Note: Rate limits should be configurable parameters — not hardcoded. Per-endpoint thresholds via config/settings (e.g. RATE_LIMIT_LOGIN_PER_MIN, RATE_LIMIT_API_PER_HOUR) with sensible defaults. This lets operators tune without code changes.

**Triage decision:** Approved as bug (critical). **Note:** Rate limits should be **configurable parameters** — not hardcoded. Per-endpoint thresholds via config/settings (e.g. `RATE_LIMIT_LOGIN_PER_MIN`, `RATE_LIMIT_API_PER_HOUR`) with sensible defaults. This lets operators tune without code changes.

Mark removed the

triage-approved

label

2026-05-13 23:56:00 +00:00

Mark commented

2026-05-14 22:21:30 +00:00

Author

Owner

Fixed in commit. Closing.

Mark closed this issue

2026-05-14 22:21:30 +00:00

Mark referenced this issue from a commit