v0.0.51 - Rate limiting and token security

melvincarvalho · melvincarvalho · commit 1d4e30b784bc · 2026-01-03T18:48:14.000+01:00
- Add @fastify/rate-limit for brute force protection
- Pod creation: 5 per IP per hour
- Login endpoints: 10 per IP per minute
- Registration: 5 per IP per hour
- TOKEN_SECRET now required in production (NODE_ENV=production)
- Random secret generated in dev mode with warning
- Update security audit report
diff --git a/SECURITY-AUDIT-2026-01-03.md b/SECURITY-AUDIT-2026-01-03.md
@@ -193,15 +193,20 @@ const SECRET = process.env.TOKEN_SECRET || 'dev-secret-change-in-production';
 | JWT signature bypass | Critical | 🟢 Fixed | v0.0.49 |
 | SSRF in OIDC discovery | Critical | 🟢 Fixed | v0.0.50 |
 | SSRF in client document fetch | Critical | 🟢 Fixed | v0.0.50 |
-| Unauthenticated pod creation | High | 🔴 Open | - |
-| Default token secret | High | 🔴 Open | - |
-| No rate limiting | Medium | 🔴 Open | - |
+| Unauthenticated pod creation | High | 🟢 Fixed | v0.0.51 |
+| Default token secret | High | 🟢 Fixed | v0.0.51 |
+| No rate limiting | Medium | 🟢 Fixed | v0.0.51 |
 | Information disclosure | Medium | 🔴 Open | - |
 
 ---
 
 ## Changelog
 
+### v0.0.51 (2026-01-03)
+- **Fixed pod creation abuse**: Rate limited to 5 pods per IP per hour
+- **Fixed default token secret**: Production (NODE_ENV=production) now requires TOKEN_SECRET env var
+- **Added rate limiting**: Login endpoints limited to 10 attempts/min, registration to 5/hour
+
 ### v0.0.50 (2026-01-03)
 - **Fixed SSRF in OIDC discovery**: Issuer URLs are now validated before fetching (HTTPS required, private IPs blocked)
 - **Fixed SSRF in client document fetch**: Client ID URLs are now validated before fetching
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "javascript-solid-server",
-  "version": "0.0.50",
+  "version": "0.0.51",
   "description": "A minimal, fast Solid server",
   "main": "src/index.js",
   "type": "module",
@@ -24,6 +24,7 @@
   },
   "dependencies": {
     "@fastify/middie": "^8.3.3",
+    "@fastify/rate-limit": "^9.1.0",
     "@fastify/websocket": "^8.3.1",
     "bcrypt": "^6.0.0",
     "commander": "^14.0.2",
diff --git a/src/auth/token.js b/src/auth/token.js
@@ -11,8 +11,29 @@ import crypto from 'crypto';
 import { verifySolidOidc, hasSolidOidcAuth } from './solid-oidc.js';
 import { verifyNostrAuth, hasNostrAuth } from './nostr.js';
 
-// Secret for signing tokens (in production, use env var)
-const SECRET = process.env.TOKEN_SECRET || 'dev-secret-change-in-production';
+// Secret for signing tokens
+// SECURITY: In production, TOKEN_SECRET must be set via environment variable
+const getSecret = () => {
+  if (process.env.TOKEN_SECRET) {
+    return process.env.TOKEN_SECRET;
+  }
+
+  // In production (NODE_ENV=production), require explicit secret
+  if (process.env.NODE_ENV === 'production') {
+    console.error('SECURITY ERROR: TOKEN_SECRET environment variable must be set in production');
+    console.error('Generate one with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"');
+    process.exit(1);
+  }
+
+  // In development, generate a random secret per process (tokens won't survive restarts)
+  const devSecret = crypto.randomBytes(32).toString('hex');
+  console.warn('WARNING: No TOKEN_SECRET set. Using random secret (tokens will not survive restarts).');
+  console.warn('Set TOKEN_SECRET environment variable for persistent tokens.');
+  return devSecret;
+};
+
+// Initialize secret once at module load
+const SECRET = getSecret();
 
 /**
  * Create a simple token for a WebID
diff --git a/src/idp/index.js b/src/idp/index.js
@@ -209,8 +209,16 @@ export async function idpPlugin(fastify, options) {
     return handleCredentialsInfo(request, reply, issuer);
   });
 
-  // POST credentials - obtain tokens
-  fastify.post('/idp/credentials', async (request, reply) => {
+  // POST credentials - obtain tokens (with rate limiting for brute force protection)
+  fastify.post('/idp/credentials', {
+    config: {
+      rateLimit: {
+        max: 10,
+        timeWindow: '1 minute',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
     return handleCredentials(request, reply, issuer);
   });
 
@@ -224,12 +232,29 @@ export async function idpPlugin(fastify, options) {
 
   // POST interaction - direct form submission (CTH compatibility)
   // This handles form submissions directly to /idp/interaction/:uid
-  fastify.post('/idp/interaction/:uid', async (request, reply) => {
+  // Rate limited to prevent brute force attacks
+  fastify.post('/idp/interaction/:uid', {
+    config: {
+      rateLimit: {
+        max: 10,
+        timeWindow: '1 minute',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
     return handleLogin(request, reply, provider);
   });
 
-  // POST login (explicit path)
-  fastify.post('/idp/interaction/:uid/login', async (request, reply) => {
+  // POST login (explicit path) - rate limited
+  fastify.post('/idp/interaction/:uid/login', {
+    config: {
+      rateLimit: {
+        max: 10,
+        timeWindow: '1 minute',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
     return handleLogin(request, reply, provider);
   });
 
@@ -248,7 +273,16 @@ export async function idpPlugin(fastify, options) {
     return handleRegisterGet(request, reply);
   });
 
-  fastify.post('/idp/register', async (request, reply) => {
+  // Registration - rate limited to prevent spam accounts
+  fastify.post('/idp/register', {
+    config: {
+      rateLimit: {
+        max: 5,
+        timeWindow: '1 hour',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, async (request, reply) => {
     return handleRegisterPost(request, reply, issuer);
   });
 
diff --git a/src/server.js b/src/server.js
@@ -1,4 +1,5 @@
 import Fastify from 'fastify';
+import rateLimit from '@fastify/rate-limit';
 import { readFile } from 'fs/promises';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
@@ -127,6 +128,20 @@ export function createServer(options = {}) {
     fastify.register(idpPlugin, { issuer: idpIssuer });
   }
 
+  // Register rate limiting plugin
+  // Protects against brute force attacks and resource exhaustion
+  fastify.register(rateLimit, {
+    global: false, // Don't apply globally, only to specific routes
+    max: 100, // Default max requests per window
+    timeWindow: '1 minute',
+    // Custom error response
+    errorResponseBuilder: (request, context) => ({
+      error: 'Too Many Requests',
+      message: `Rate limit exceeded. Try again in ${Math.ceil(context.after / 1000)} seconds.`,
+      retryAfter: Math.ceil(context.after / 1000)
+    })
+  });
+
   // Global CORS preflight
   fastify.addHook('onRequest', async (request, reply) => {
     // Add CORS headers to all responses
@@ -224,8 +239,17 @@ export function createServer(options = {}) {
     }
   });
 
-  // Pod creation endpoint
-  fastify.post('/.pods', handleCreatePod);
+  // Pod creation endpoint with rate limiting
+  // Limit: 5 pods per IP per hour to prevent resource exhaustion and namespace squatting
+  fastify.post('/.pods', {
+    config: {
+      rateLimit: {
+        max: 5,
+        timeWindow: '1 hour',
+        keyGenerator: (request) => request.ip
+      }
+    }
+  }, handleCreatePod);
 
   // Mashlib static files (served from root like NSS does)
   if (mashlibEnabled) {
