fix(security): normalize /v1 paths for rate limit tier matching - #6879
Open
prakhar-singh1928 wants to merge 2 commits into
Open
prakhar-singh1928 wants to merge 2 commits into
prakhar-singh1928 wants to merge 2 commits into
Conversation
Normalize request paths in RateLimitMiddleware by stripping root path, API aliases, and /v1 prefixes before pattern matching. This prevents versioned endpoints from falling through to the LOW tier default. Signed-off-by: prakhar-singh1928 <prakhar.singh1928@ibm.com>
prakhar-singh1928
requested review from
Lang-Akshay,
brian-hussey,
crivetimihai,
ja8zyjits and
msureshkumar88
as code owners
September 18, 2026 13:57
…ormalization Remove dead version guards from tier patterns that were unreachable after _normalize_path_for_matching strips /v1 from every path before matching: - SESSION_REFRESH: ^(/v1)?/auth/refresh$ -> ^/auth/refresh$ - CRITICAL_INVITATION: ^/(?:v1/)?teams/... -> ^/teams/... Extract path normalization in dispatch so it runs once per request. Introduce _get_tier_for_normalized and _get_tier_name_for_normalized as the inner matching primitives; get_endpoint_tier and _get_tier_name delegate to them, preserving the public API. Update the forged-HMAC test to patch _get_tier_for_normalized, which is the method dispatch now calls directly. Add deny-path regression assertions to test_endpoint_tier_matches_v1_versioned_paths confirming that /v1/auth/email/login, /v1/tokens, /v1/oauth/token, and /v1/rbac/roles never return the 500 rpm LOW default. Signed-off-by: prakhar-singh1928 <prakhar.singh1928@ibm.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
🔗 Related Issue
Closes #
📝 Summary
Normalize request paths in
RateLimitMiddlewareby stripping root path, API aliases, and/v1prefixes before pattern matching.Previously,
RateLimitMiddlewarecompiled regex patterns against unversioned paths (e.g.,^/auth/email/...,^/(tokens|oauth|rbac)(/|$)), while endpoints were mounted under/v1. As a result, requests to versioned routes fell through to the defaultLOWtier (500 rpm) instead of matching their intendedCRITICAL(10 rpm) orHIGH(30 rpm) tiers. Normalizing the path before evaluating tier rules alignsRateLimitMiddlewarewithTokenScopingMiddlewareand restores correct rate-limiting enforcement.📏 Reviewability
triage🏷️ Type of Change
🧪 Verification
Ran unit tests and static analysis linters across the modified files and test suite:
make ruff && make interrogate && make pylint && make bandituv run pytest tests/unit/mcpgateway/middleware/test_rate_limit_middleware.pymake coverage✅ Checklist
make black isort pre-commit)📓 Notes (optional)
Added parameterized unit test
test_endpoint_tier_matches_v1_versioned_pathstotests/unit/mcpgateway/middleware/test_rate_limit_middleware.pyverifying/v1-prefixed requests correctly matchCRITICAL,CRITICAL_SSO,CRITICAL_INVITATION,SESSION_REFRESH,HIGH,HIGH_APPBRIDGE,MEDIUM, andLOWtiers.