Marc-André Bombeck 20812b54f5 fix(webhooks): rate-limit every verb that checks the shared secret ...

The Withings entrypoints, the Telegram bot webhook and the Coolify deploy
hook limited POST and left the verification verbs unlimited. GET and HEAD
compare the same secret and answer 200 against 401, which is an oracle for
guessing it and a free load channel besides; timingSafeEqual protects the
timing channel, not the status code. The project's rule is that the
per-source limit runs before secret verification, and it was being applied
per handler rather than per file.

Each verification verb now runs the same limit its POST sibling used, on the
same bucket. Telegram and the deploy hook grow the small local helper the
Withings routes already share. HEAD re-shapes the limiter's JSON envelope
into a bodyless 429 and keeps the rate-limit headers.

The new guard walks every webhook route from the filesystem, resolves which
local helpers reach a comparison and which reach the limiter, and fails when
an exported verb reaches a comparison without the limiter in front of it. It
asserts a non-zero match count so an empty match set cannot read as green.
WHOOP already passed: it exports POST only.

2026-09-03 01:42:56 +02:00

..

__tests__

fix(webhooks): rate-limit every verb that checks the shared secret

2026-09-03 01:42:56 +02:00

route.ts

fix(webhooks): rate-limit every verb that checks the shared secret

2026-09-03 01:42:56 +02:00