Description
Global IP-based rate limiting alone is insufficient to prevent transaction spam or replay attempts on critical financial routes. We need to implement rate limiting scoped by authenticated public key (SEP-10 JWT context) for sensitive routes such as settlement creation and XDR submission.
Context & Requirements
The API uses @fastify/rate-limit for generic global rate limiting. However, users sharing public IP addresses (such as NAT environments or shared networks) can inadvertently throttle each other, while single accounts could still flood transaction endpoints.
Requirements:
- Configure rate limit rules in Fastify for sensitive endpoints (
POST /settlements, POST /settlements/submit).
- Key the rate limit bucket by authenticated user public key extracted from SEP-10 JWT claims rather than IP address alone.
- Allow custom configurable thresholds per endpoint (e.g. 10 submission requests per minute per user key).
- Return standard HTTP 429 Too Many Requests response format when limits are exceeded.
Acceptance Criteria
Implementation Guidance
- Extend existing
@fastify/rate-limit configuration or create custom route hooks in src/routes/settlements.ts / src/middleware/rateLimit.ts.
- Use
request.user.publicKey (set by SEP-10 auth handler) as key generator function for @fastify/rate-limit.
- Ensure unauthenticated requests fall back safely to IP address key generation.
Testing & Validation
- Add integration tests in
tests/routes/settlements.test.ts sending rapid repeated requests from identical and distinct JWT user tokens.
- Confirm 429 response structure matches standard API response schemas.
- Ensure
npm test passes without regression.
Submission Guidelines
- Link PR using "Closes #".
- Maintainer assignment must be completed before starting PR development.
- Adhere strictly to clean TypeScript standards.
Wave complexity: Medium
Description
Global IP-based rate limiting alone is insufficient to prevent transaction spam or replay attempts on critical financial routes. We need to implement rate limiting scoped by authenticated public key (SEP-10 JWT context) for sensitive routes such as settlement creation and XDR submission.
Context & Requirements
The API uses
@fastify/rate-limitfor generic global rate limiting. However, users sharing public IP addresses (such as NAT environments or shared networks) can inadvertently throttle each other, while single accounts could still flood transaction endpoints.Requirements:
POST /settlements,POST /settlements/submit).Acceptance Criteria
POST /settlements/submit) limit requests per authenticated user public key.Retry-Afterheader.Implementation Guidance
@fastify/rate-limitconfiguration or create custom route hooks insrc/routes/settlements.ts/src/middleware/rateLimit.ts.request.user.publicKey(set by SEP-10 auth handler) as key generator function for@fastify/rate-limit.Testing & Validation
tests/routes/settlements.test.tssending rapid repeated requests from identical and distinct JWT user tokens.npm testpasses without regression.Submission Guidelines
Wave complexity: Medium