dohertj2/lmxopcua
1
0
Fork 0
Code Issues 43 Pull Requests Actions Packages Projects Releases Wiki Activity

Security: per-remote-endpoint pre-auth API-key miss budget (widen IOpcUaUserAuthenticator seam) #751

New Issue
Open
opened 2026-11-06 15:27:07 -05:00 by dohertj2 · 0 comments
dohertj2 commented 2026-11-06 15:27:07 -05:00
Owner
Copy Link
Copy Source

Lane C (#733, commit e04156d8) added a pre-auth guard against API-key-id DoS: the KnownIdSet plus a MissBurst/MissRefillPerSecond token bucket. The budget is process-wide, not per remote endpoint, because the SDK impersonation callback behind the IOpcUaUserAuthenticator seam does not carry the client's address. One noisy client can therefore drain the miss budget for everyone while the id set is unavailable.

Work: widen the seam in the OpcUaServer project so it carries the remote endpoint, then account misses per endpoint. Keep the process-wide bucket as a backstop. docs/security.md calls this "a Wave 3 follow-up", but no Wave 3 lane owns it and no issue exists.

Source: docs/security.md:265-267 (section on the API-key store bounds). Related: #733, review 03 (pre-auth DoS finding).

Lane C (#733, commit `e04156d8`) added a pre-auth guard against API-key-id DoS: the `KnownIdSet` plus a `MissBurst`/`MissRefillPerSecond` token bucket. The budget is **process-wide, not per remote endpoint**, because the SDK impersonation callback behind the `IOpcUaUserAuthenticator` seam does not carry the client's address. One noisy client can therefore drain the miss budget for everyone while the id set is unavailable. Work: widen the seam in the OpcUaServer project so it carries the remote endpoint, then account misses per endpoint. Keep the process-wide bucket as a backstop. docs/security.md calls this "a Wave 3 follow-up", but no Wave 3 lane owns it and no issue exists. Source: docs/security.md:265-267 (section on the API-key store bounds). Related: #733, review 03 (pre-auth DoS finding).
dohertj2 added the priority:p3migratedtype:followup labels 2026-11-06 15:28:00 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
auto-managed
queue management
 blocked
Blocked by dependency or external hold
 cross-driver
queue management
 cross-repo
Needs coordinated change in another family repo (wire contract etc.)
 driver/abcip
queue management
 driver/ablegacy
queue management
 driver/focas
queue management
 driver/mqtt
MQTT / Sparkplug B broker-subscribe driver
 driver/opcuaclient
queue management
 driver/s7
queue management
 driver/twincat
queue management
 migrated
Migrated from a markdown backlog (2026-11 standardization)
 phase/1
queue management
 phase/2
queue management
 phase/3
queue management
 phase/4
queue management
 phase/5
queue management
 phase/6
queue management
 priority:p0
Must-have / blocking
 priority:p1
High priority
 priority:p2
Normal priority
 priority:p3
Low priority / nice to have
 queue/blocked
queue management
 queue/done
queue management
 queue/failed
queue management
 queue/in-progress
queue management
 queue/queued
queue management
 type:bug
Defect in shipped behaviour
 type:debt
Technical debt / hygiene
 type:deploy-gate
Rollout/deploy/migration step not yet done on an environment
 type:docs
Documentation work
 type:feature
Feature implementation
 type:followup
Follow-up deferred from a plan, PR or gate
 type:infra
Infrastructure and scaffolding
 type:review-finding
Unfixed finding from an architecture/code review
 type:test
Test work
No Label migrated priority:p3 type:followup
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#751
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?