Skip to content

Conversation

@sujalsalekar
Copy link

This PR implements critical security and performance improvements to the rate limiting, token validation, and cache management systems.

Key Changes:

  1. Token Validation Enhancements

    • Added strict Bearer token format validation
    • Implemented base64url encoding checks
    • Added minimum token length requirement (32 chars)
    • Improved security logging for invalid tokens
  2. Rate Limiting Improvements

    • Implemented configurable per-token rate limits
    • Added concurrent request tracking
    • Differentiated limits for anonymous vs authenticated requests
    • Added proper cleanup of concurrent request counters
    • Fixed type safety issues with rate limit responses
  3. Cache Management Optimization

    • Implemented Stale-While-Revalidate (SWR) pattern
    • Added configurable cache TTLs:
      • Default TTL: 1 hour
      • Stale window: 5 minutes
      • Background refresh: 55 minutes
    • Added background refresh for near-expiry cache entries
    • Improved error handling for cache operations

Technical Details:

  • Added proper TypeScript type definitions
  • Fixed KV store value handling (string-based storage)
  • Implemented proper execution context for background tasks
  • Added comprehensive error logging
  • Fixed type safety issues with rate limit enum usage

woss pushed a commit to woss/fork-web3storage-freeway that referenced this pull request Sep 16, 2025
I attempted to reproduce the issue described in
[storacha#176](storacha/project-tracking#176) but was
unsuccessful. As a result, I am re-enabling OpenTelemetry for all
environments where it was previously disabled due to this issue.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant