feat: add configurable rate limit for client registration - #630
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📜 Recent review details⏰ Context from checks skipped due to timeout. (5)
🔇 Additional comments (3)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe change documents and validates ChangesOAuth registration limiting
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
index.ts (1)
13798-13813: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDocument the registration limiter as process-local or use shared storage.
The registration limiter passes no shared
store, soexpress-rate-limitfalls back to process-localMemoryStorecounters. In a multi-instance deployment, registration requests can pass this limit across processes; either configure shared storage or updatedocs/configuration/environment-variables.md#L580to make the documented limit clearly per process/instance.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@index.ts` around lines 13798 - 13813, Update the registration rate-limit configuration in index.ts around clientRegistrationRateLimitOptions to use shared storage, or explicitly document its process-local/instance-scoped behavior. If retaining the default MemoryStore, update docs/configuration/environment-variables.md lines 580-583 to state that OAUTH_REGISTER_RATE_LIMIT_PER_HOUR applies independently per process/instance; if shared storage is configured instead, document that setup accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@index.ts`:
- Around line 1068-1073: Update validation of OAUTH_REGISTER_RATE_LIMIT_PER_HOUR
to reject malformed and non-integer strings before applying the 1–1000 range
check; replace the permissive parseInt-based validation with strict numeric
validation so values like “20foo” and “1.5” fail. Apply the same strict parsing
at the runtime rate-limit parsing site, preserving valid integer behavior.
---
Outside diff comments:
In `@index.ts`:
- Around line 13798-13813: Update the registration rate-limit configuration in
index.ts around clientRegistrationRateLimitOptions to use shared storage, or
explicitly document its process-local/instance-scoped behavior. If retaining the
default MemoryStore, update docs/configuration/environment-variables.md lines
580-583 to state that OAUTH_REGISTER_RATE_LIMIT_PER_HOUR applies independently
per process/instance; if shared storage is configured instead, document that
setup accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a22c07d6-8864-4949-9039-09b8a0d8c01c
📒 Files selected for processing (2)
docs/configuration/environment-variables.mdindex.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: test
- GitHub Check: integration-test
- GitHub Check: docs-build
2 participants
In certain scenarios, like using multiple windows of Kiro IDE, clients will multiple registrations at once (e.g. n windows of Kiro IDE open => n client registrations).
Currently the mcp uses the default upstream rate limit of 20 requests per hour for the
POST /registerendpoint. This PR adds the capability to adjust this rate limit to account for client specific technical details like the one mentioned above.