Repository navigation
[Security] Rate-limit fallback fails open silently in production #483
Description
Description
api/_lib/middleware.ts uses Upstash Redis for distributed rate limiting when UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN are set, falling back to an in-memory per-process Map otherwise. The code's own comment already says the fallback "is not shared across workers and should not be used in production," but nothing enforces that: if those env vars are missing on a production deploy, checkRateLimit (line ~73) silently uses the fallback with no warning, log, or error.
Steps to Reproduce
- Deploy to Vercel production without
UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKENset. - Observe that the app starts and serves requests normally, using the per-instance fallback silently.
Expected Behavior
A production deploy missing the required rate-limit env vars should fail loudly (throw at startup, or log a critical error and reject requests), not silently degrade to a per-instance limiter that's effectively no limit at all across concurrent Vercel workers.
Actual Behavior
Silent fallback, no signal anywhere that rate limiting is not actually distributed.
Environment
| Field | Value |
|---|---|
| Network | N/A |
| Wallet | N/A |
| Protocol affected | API |
| Browser (if frontend) | N/A |
| Node.js version | N/A |
| pnpm version | N/A |
Possible Cause / Fix
Check process.env.VERCEL_ENV === "production" at module load in api/_lib/middleware.ts; if true and the Upstash env vars are missing, throw rather than silently constructing ratelimit as null. Local dev and preview deploys should keep working with the in-memory fallback, since VERCEL_ENV is unset locally and "preview" on preview deploys.
Activity
yunus-dev-codecrafter commentedon Aug 6, 2026
Hi! I've carefully reviewed the entire task description and fully understand the requirements and expected outcome.
I have experience working on similar tasks and I'm confident I can complete this within about an hour. I'd be happy to take ownership of this issue and submit a clean, well-tested solution promptly.
If it's available, please assign it to me. Thank you!
onyemaechiezekiel9 commentedon Aug 6, 2026
Hello, I have gone through the issue and I would love to work on this swiftly
subheeksh5599 commentedon Aug 6, 2026
hi, interested. recently shipped anchorfx on stellar mainnet and completed fwc26 issues across grainlify, finchippay, guildpass — stellar ecosystem dev (soroban, sdk, frontend, testing). approach:
can submit a PR today. happy to adjust to feedback.
playmaker410 commentedon Aug 7, 2026
Hi Maintainer,
I’d love to take this on. I have hands-on experience with Rust, Soroban, Cairo, and TypeScript, and I’m confident I can deliver a solid solution within 24 hours.
collinsezedike commentedon Aug 7, 2026
Go for it, @subheeksh5599
grantfox-oss commentedon Aug 7, 2026
🦊 GrantFox — @subheeksh5599 has been assigned to this issue!
Next steps:
Closes #483)Good luck! Track your progress on GrantFox.
collinsezedike commentedon Aug 11, 2026
Hey @subheeksh5599, checking in, it's been a few days since you picked this up. No rush, just wanted to see how it's going and if you need anything from me.
grantfox-oss commentedon Aug 13, 2026
🎉 This issue has been marked as completed on GrantFox!
@subheeksh5599's PR #506 was approved and merged by @collinsezedike.
🏆 @subheeksh5599: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (433 total points). Track your full progress on GrantFox.
👏 Great work, @subheeksh5599! Keep contributing to drydocs.