Summary
The HTTP_RATE_LIMITS configuration (used for non-login HTTP rate limiters) currently does not validate that the configured windowMs and max values are positive integers. Zero or negative values could silently produce broken or permissive rate-limiting behavior.
Proposed improvement
Add input validation when consuming HTTP_RATE_LIMITS entries to reject (or warn on) zero/negative values for windowMs and max.
Context
Identified during review of PR #2568 (#2568) as a valid improvement on pre-existing code outside the scope of that security fix.
Requested by @dirkwa.
Summary
The
HTTP_RATE_LIMITSconfiguration (used for non-login HTTP rate limiters) currently does not validate that the configuredwindowMsandmaxvalues are positive integers. Zero or negative values could silently produce broken or permissive rate-limiting behavior.Proposed improvement
Add input validation when consuming
HTTP_RATE_LIMITSentries to reject (or warn on) zero/negative values forwindowMsandmax.Context
Identified during review of PR #2568 (#2568) as a valid improvement on pre-existing code outside the scope of that security fix.
Requested by @dirkwa.