Summary
Add a coherent application-wide rate-limiting policy for Huabu production HTTP routes instead of addressing CodeQL js/missing-rate-limiting findings one endpoint at a time.
Motivation
CodeQL currently reports open missing-rate-limiting alerts on production workspace and Canvas routes that perform filesystem or other potentially expensive operations. Huabu has owner authorization and a fail-closed remote deployment boundary, but authorization alone does not bound request volume. The repository currently has no rate-limiting dependency or canonical policy.
Known production findings include code-scanning alerts #101, #102, #139, #140, and #141. Test-only alerts such as #136 are a separate static-analysis false-positive pattern and should not drive the production design.
Proposed direction
- Evaluate and adopt
@fastify/rate-limit, which current CodeQL versions recognize.
- Register the policy centrally in the Fastify application so new routes inherit protection by default.
- Define limits and keys appropriate for Huabu's single-owner model.
- Specify behavior for loopback requests, Basic-authenticated remote browser requests, RFS bearer traffic, SSE streams, uploads, and health/readiness endpoints.
- Preserve correct behavior behind supported TLS terminators without trusting arbitrary forwarding headers.
- Return a consistent
429 response and expose enough logging/telemetry to diagnose legitimate throttling.
- Add tests for enforcement, reset windows, exemptions, and deployment configurations.
- Update
docs/architecture/deployment-security.md with the resulting contract.
Acceptance criteria
- Expensive production HTTP routes are protected by a documented, centrally enforced rate limit.
- Authentication and authorization remain independent from rate limiting.
- Long-lived SSE and normal local development workflows are not inadvertently broken.
- Remote deployment behavior remains fail-closed and proxy identity is not inferred from untrusted forwarding headers.
- Relevant CodeQL
js/missing-rate-limiting production alerts are resolved or explicitly dispositioned with documented compensating controls.
- Focused server tests and repository validation pass.
References
Summary
Add a coherent application-wide rate-limiting policy for Huabu production HTTP routes instead of addressing CodeQL
js/missing-rate-limitingfindings one endpoint at a time.Motivation
CodeQL currently reports open missing-rate-limiting alerts on production workspace and Canvas routes that perform filesystem or other potentially expensive operations. Huabu has owner authorization and a fail-closed remote deployment boundary, but authorization alone does not bound request volume. The repository currently has no rate-limiting dependency or canonical policy.
Known production findings include code-scanning alerts #101, #102, #139, #140, and #141. Test-only alerts such as #136 are a separate static-analysis false-positive pattern and should not drive the production design.
Proposed direction
@fastify/rate-limit, which current CodeQL versions recognize.429response and expose enough logging/telemetry to diagnose legitimate throttling.docs/architecture/deployment-security.mdwith the resulting contract.Acceptance criteria
js/missing-rate-limitingproduction alerts are resolved or explicitly dispositioned with documented compensating controls.References