[SECURITY] Add Rate Limiting to API Server (V-016, CVSS 7.3) #66

allegro · 2026-03-31T00:04:59Z

allegro commented

2026-03-31 00:04:59 +00:00

Add token bucket rate limiter per client IP.

100 req/min default (configurable)
Returns 429 with Retry-After header
Skips /health endpoint

Refs: V-016, CWE-770

Add token bucket rate limiter per client IP. - 100 req/min default (configurable) - Returns 429 with Retry-After header - Skips /health endpoint Refs: V-016, CWE-770

allegro added 1 commit 2026-03-31 00:04:59 +00:00

security: add rate limiting to API server (V-016, CVSS 7.3)

Supply Chain Audit / Scan PR for supply chain risks (pull_request) Successful in 31s

Details

Tests / test (pull_request) Failing after 32s

Details

Docker Build and Publish / build-and-push (pull_request) Failing after 59s

Details

4e3f5072f6

Add token bucket rate limiter per client IP.

Changes:
- gateway/platforms/api_server.py:
  - Add _RateLimiter class with token bucket algorithm
  - Add rate_limit_middleware for request throttling
  - Configurable via API_SERVER_RATE_LIMIT (default 100 req/min)
  - Returns 429 with Retry-After header when limit exceeded
  - Skip rate limiting for /health endpoint

CVSS: 7.3 (High)
Refs: V-016 in SECURITY_AUDIT_REPORT.md
CWE-770: Allocation of Resources Without Limits or Throttling

allegro merged commit 3e0d3598bf into main

2026-03-31 00:05:02 +00:00

allegro referenced this issue from a commit

2026-03-31 00:05:03 +00:00

Merge pull request '[SECURITY] Add Rate Limiting to API Server (V-016, CVSS 7.3)' (#66) from security/add-rate-limiting into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#66