[thomasluizon]

Anonymous auth and waitlist requests previously acquired only an attacker-chosen email bucket. Rotating the email could therefore keep sending mail or probing codes from one source without exhausting a source quota.

DistributedRateLimitFilter now acquires both the original email bucket and a separate IP bucket for anonymous email requests. It evaluates both dimensions and rejects when either refuses a permit. The rejected dimension supplies the existing retry header and structured rejection log. Authenticated user partitions, session-verified refresh partitions, the support fail-open exemption, and the 429 response schema are preserved.

The implementation lands in src/Orbit.Api/RateLimiting/DistributedRateLimitAttribute.cs and src/Orbit.Infrastructure/Services/DistributedRateLimitService.cs. Explicit auth-ip and waitlist-ip policies keep source ceilings independent of the existing account ceilings. src/Orbit.Api/appsettings.json pins ForwardedHeaders:KnownNetworks to 10.0.0.0/8 for both Render environments, and BuildForwardedHeadersOptions carries the evidence-linked reason while retaining ForwardLimit = 1.

Regression coverage extends the partition, filter and waitlist controller suites. The waitlist test invokes the real controller and command handler with a mocked email port, so only 15 of 20 distinct-address attempts send confirmation mail. Auth send-code and OAuth verify-code stop after 30 of 40 attempts. Other cases cover original account limits across sources, shared NAT traffic, nine ordinary requests, unknown IPs, authenticated callers, refresh tokens, both rejection windows, and store failure. A structural guard enumerates every email-partitioned policy and requires its matching IP policy. Additional middleware tests use committed configuration and the actual forwarded-header middleware; the existing bot-protection ordering test now covers rejection by either dimension.

Render evidence

The work order supplies this staging log observation from the same Render platform, region and DNS-only routing as production, observed at 2026-10-18T09:37:47Z:

Rate limit rejected. Policy=refresh PartitionKey=ip:10.24.103.103 Count=10/10 ... POST /api/auth/refresh

Sixteen forged refresh requests from public client address 177.189.50.154 reached the refresh ceiling under the private peer address. This established that the proxy peer was 10.24.103.103 and that forwarded client addresses were previously discarded. The final work-order decision authorizes the committed network and enables the IP dimension immediately. Production was not probed.

The actual middleware invocation confirms one trusted hop: peer 10.24.103.103 plus X-Forwarded-For: 203.0.113.10 resolves to 203.0.113.10; the two-address header 203.0.113.10, 10.0.0.1 resolves to 10.0.0.1. Both headers are ignored from untrusted peer 198.51.100.7. These tests exercise the framework interface directly without an invented external response fixture.

Assumptions

• Use the authorized starting ceilings auth-ip 30 per 60 seconds and waitlist-ip 15 per 600 seconds, rather than applying the tighter per-email ceilings to all callers behind a shared NAT. Account ceilings remain auth 10 per 60 seconds and waitlist 5 per 600 seconds.
• Preserve the explicitly required 429 response schema and report the rejecting dimension through its existing log fields and retry window, rather than adding a response field or a consumer contract change.
• Extend RequireBotProtectionFilterTests.cs and add Extensions/ForwardedHeadersTests.cs because the composite filter changes the ordering fixture and the trust configuration needs real middleware coverage, rather than limiting coverage to the originally listed files.

Test evidence

The unchanged tests passed with the vulnerability present, including TryResolveEmailPartitionKey_Auth_DifferentEmailsMapToDifferentKeys:

dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~DistributedRateLimitPartitionKeyTests|FullyQualifiedName~DistributedRateLimitFilterTests|FullyQualifiedName~WaitlistControllerRateLimitTests'

Output excerpt: Com falha: 0, Aprovado: 31, Ignorado: 0, Total: 31. Exit 0.

Before changing production code, the extended suites exercised the missing IP ceiling:

dotnet test tests/Orbit.Infrastructure.Tests --filter 'FullyQualifiedName~AuthRoutes_RotatingEmails|FullyQualifiedName~Join_RotatingEmails'

AuthRoutes_RotatingEmails_ExhaustIpCeiling failed for both auth send-code and OAuth verify-code at request 31. Join_RotatingEmails_BoundsConfirmationSendsByIpCeiling failed at request 16. All three reported Expected context.Result to be Microsoft.AspNetCore.Mvc.ObjectResult, but found <null>. Output excerpt: Com falha: 3, Aprovado: 0, Ignorado: 0, Total: 3. Exit 1.

With the implementation in place, the same rotation cases pass within the final focused run. The former different-email test was deliberately rewritten as Auth_DifferentEmailsKeepSeparateEmailKeysAndShareIpKey, retaining distinct email keys and asserting their shared IP bucket.

dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter 'FullyQualifiedName~DistributedRateLimitPartitionKeyTests|FullyQualifiedName~DistributedRateLimitFilterTests|FullyQualifiedName~WaitlistControllerRateLimitTests|FullyQualifiedName~ForwardedHeadersTests|FullyQualifiedName~RateLimitRejectsBeforeBotVerification'

Output excerpt: Com falha: 0, Aprovado: 50, Ignorado: 0, Total: 50. Exit 0.

dotnet build Orbit.slnx

Output excerpt: 13 Aviso(s) and 0 Erro(s). Exit 0. OpenAPI generation produced no contract diff.

dotnet test tests/Orbit.Domain.Tests --no-build
dotnet test tests/Orbit.Application.Tests --no-build

Output excerpts: Domain Com falha: 0, Aprovado: 671, Ignorado: 0, Total: 671; Application Com falha: 0, Aprovado: 5485, Ignorado: 0, Total: 5485. Both exit 0.

The first dotnet test tests/Orbit.Infrastructure.Tests --no-build run found one old mock that returned a decision only for the email dimension: RateLimitRejectsBeforeBotVerification_WithRetryHeader. It reported 3373 passes and one failure. The follow-up commit configures both decisions and tests both rejection paths, retaining the assertion that bot verification is never called.

The final full solution run includes the corrected Infrastructure suite and the analyzer suite:

dotnet test

Output excerpts:

Com falha:     0, Aprovado:    32, Ignorado:     0, Total:    32, Duração: 3 s - Orbit.Analyzers.Tests.dll (net10.0)
Com falha:     0, Aprovado:   671, Ignorado:     0, Total:   671, Duração: 2 s - Orbit.Domain.Tests.dll (net10.0)
Com falha:     0, Aprovado:  5485, Ignorado:     0, Total:  5485, Duração: 10 s - Orbit.Application.Tests.dll (net10.0)
Com falha:     0, Aprovado:  3375, Ignorado:     0, Total:  3375, Duração: 24 s - Orbit.Infrastructure.Tests.dll (net10.0)

Exit 0. All four projects passed: 9563 tests, zero failures and zero skipped. Both commits passed the installed pre-commit hooks, including formatting, dash, timeless text and suppression checks.

Closes thomasluizon/orbit-tickets#114. Implements ORB-108.

[pullfrog]

Important

The new auth IP quota groups unrelated web users behind the existing BFF, allowing one caller to exhaust other users' email-login allowance on the same egress.

Reviewed changes: Reviewed the composite anonymous rate limits, forwarded-header trust configuration, existing authentication paths, and web consumer routing.

• Composite enforcement: Anonymous email requests consume both email and source-IP buckets, with separate auth and waitlist IP ceilings and the existing rejection response.
• Proxy trust: Configures the Render private network as trusted while retaining one-hop forwarded-header processing.
• Preserved paths: Keeps authenticated user partitions, verified refresh-token partitions, and support's store-failure exemption.
• Regression coverage: Covers email rotation, shared sources, rejection windows, store failures, waitlist email sends, and bot-filter ordering; the focused test run passed all 50 tests.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

No new blocking issues found.

Reviewed changes: Reviewed the two follow-up commits since ed3575c1, covering authenticated BFF source forwarding and shared-secret provisioning, with the full PR diff for context.

• Isolated BFF clients: Accepted canonical end-client IPs only with a matching forwarding secret, retained connection-IP enforcement for untrusted requests, and bounded invalid authenticated forwarding through the unknown bucket.
• Provisioned shared secrets: Generated and persisted separate production and staging secrets, wiring each value into its API and web environment groups.
• Verified regressions: Passed all 3,390 Infrastructure tests and all four forwarding-secret configuration tests, including independent BFF clients, email rotation, forged headers and IP normalization.

The resolved finding remains settled under the recorded web-before-API release dependency on thomasluizon/orbit-tickets#1527; this review does not claim that the web counterpart is already deployed. Terraform CLI validation was unavailable because terraform is not installed.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud