[High] No Rate Limiting on RPC Endpoints (Security/Stability) #20

New issue

Closed

opened 2026-02-11 18:50:18 +00:00 by thabeta · 0 comments

thabeta commented

2026-02-11 18:50:18 +00:00

Owner

Issue

The JSON-RPC handler in caddy/openrpc/handler.go lacks rate limiting. An attacker can spam expensive endpoints like services.create or rpc.discover to cause a Denial of Service (DoS) or exhaust database connections.

Impact

DoS vulnerability allowing service degradation
Database connection exhaustion
Uncontrolled resource consumption

Remediation

Implement a Caddy-native or middleware-level rate limiter based on IP and User Public Key. Consider implementing:

Per-IP rate limiting (e.g., 100 req/min)
Per-user rate limiting based on public key
Endpoint-specific limits for expensive operations

Files Affected

caddy/openrpc/handler.go
caddy/openrpc/module.go (rate limiting configuration)

## Issue The JSON-RPC handler in `caddy/openrpc/handler.go` lacks rate limiting. An attacker can spam expensive endpoints like `services.create` or `rpc.discover` to cause a Denial of Service (DoS) or exhaust database connections. ## Impact - DoS vulnerability allowing service degradation - Database connection exhaustion - Uncontrolled resource consumption ## Remediation Implement a Caddy-native or middleware-level rate limiter based on IP and User Public Key. Consider implementing: 1. Per-IP rate limiting (e.g., 100 req/min) 2. Per-user rate limiting based on public key 3. Endpoint-specific limits for expensive operations ## Files Affected - `caddy/openrpc/handler.go` - `caddy/openrpc/module.go` (rate limiting configuration)