From 04e25f4e62e567361c651056399a7dd0dafc3064 Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Mon, 27 Jul 2026 00:58:40 -0700 Subject: [PATCH] fix(rate-limit): fail open when the bearer-identity DB lookup errors (#9223) validateBearerForRateLimit only classifies which rate-limit bucket a caller lands in, not the real authorization decision -- but its session-token DB read was unguarded, so any driver error there escaped the whole middleware chain uncaught and surfaced as a bare non-JSON 500 for whatever route was hit. Wrap it in the same fail-open try/catch already used for the Durable Object call in this file (#5000). --- src/auth/rate-limit.ts | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/auth/rate-limit.ts b/src/auth/rate-limit.ts index 84b31067c..85f40c429 100644 --- a/src/auth/rate-limit.ts +++ b/src/auth/rate-limit.ts @@ -263,7 +263,17 @@ async function peekWebhookInstallationId(c: Context<{ Bindings: Env }>): Promise } async function validateBearerForRateLimit(c: Context<{ Bindings: Env }>, token: string): Promise { - return Boolean((await authenticatePrivateToken(c.env, token)) ?? (await authenticateInternalToken(c.env, token))); + try { + return Boolean((await authenticatePrivateToken(c.env, token)) ?? (await authenticateInternalToken(c.env, token))); + } catch (error) { + // Fail OPEN (#5000, same reasoning as the DO-fetch catch in checkRateLimitBucket above): this call only + // classifies which rate-limit bucket a caller lands in (falling back to IP-keying below), it is never the + // actual authorization decision -- a D1 hiccup during the session-token lookup inside + // authenticatePrivateToken must not crash the whole request (no app.onError is registered), it should + // just be treated the same as an unrecognized token. + console.warn(JSON.stringify({ level: "warn", event: "rate_limit_identity_check_failed", message: error instanceof Error ? error.message : String(error) })); + return false; + } } const LOOPBACK_PEER_IPS = new Set(["127.0.0.1", "::1"]);