Description
The global rate limiter middleware is commented out in backend/src/server.js, leaving the API unprotected against abuse at the top level.
Location
backend/src/server.js line 178:
// Rate limiting
// app.use(rateLimitMiddleware(global));
Impact
- Without global rate limiting, the API is vulnerable to DoS attacks and brute-force requests
- Individual routes have rate limit annotations (
rateLimitMiddleware(compile), etc.) but the global firewall is disabled
- Route-level rate limiting also silently degrades to memory fallback if Redis is unavailable
Required Fix
- Uncomment the global rate limiter in
server.js
- Ensure the global rate limit config has sensible defaults (currently 1000 requests per 15 minutes)
- Consider whether Redis must be available for production or if memory fallback is acceptable
Reference
Identified during full codebase audit of soroban-playground.
Description
The global rate limiter middleware is commented out in
backend/src/server.js, leaving the API unprotected against abuse at the top level.Location
backend/src/server.jsline 178:Impact
rateLimitMiddleware(compile), etc.) but the global firewall is disabledRequired Fix
server.jsReference
Identified during full codebase audit of soroban-playground.