github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-05-22 14:21:55 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

[PR #4032] [CLOSED] fix: prevent double rate-limit increment for API key authentication (#4023) #5147

New Issue
Closed
opened 2026-03-13 12:12:09 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-03-13 12:12:09 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/better-auth/better-auth/pull/4032
Author: @Louis454545
Created: 8/15/2025
Status: ❌ Closed

Base: canary ← Head: fix/api-key-double-rate-limit-4023

📝 Commits (3)

  • d02838d fix: prevent double rate-limit increment for API key authentication (#4023)
  • ce7c6bd security: fix rate limiting bypass vulnerability
  • 30354cc fix: prevent double rate-limit increment using plugin rate limiter

📊 Changes

1 file changed (+9 additions, -0 deletions)

View changed files

📝 packages/better-auth/src/plugins/api-key/index.ts (+9 -0)

📄 Description

Summary

Fixes #4023

This PR resolves the double rate-limit increment issue that occurs when authenticating via API key. Previously, both verifyApiKey() and getSession() would trigger rate limiting independently, causing users to burn through their quota twice as fast.

Changes Made

  • Added skipGlobalRateLimit flag to AuthContext - allows components to signal that global rate limiting should be skipped
  • Enhanced global rate limiter - automatically detects API key headers and skips global rate limiting when API keys are present
  • Updated API key validation - sets context flag after successful validation to prevent subsequent rate limiting
  • Exposed API key configuration - allows rate limiter to access plugin's header configuration

Technical Details

The fix works on two levels:

  1. Automatic detection: When API key headers are present, global rate limiting is automatically skipped since the API key plugin handles its own rate limiting
  2. Context flag: For explicit verifyApiKey() calls, a context flag prevents double rate limiting on subsequent operations

Test Plan

  • Verified API key detection logic works correctly for various header configurations
  • Confirmed type safety for new skipGlobalRateLimit property
  • Tested backward compatibility - non-API key requests continue working normally
  • Validated that API key rate limiting still functions independently

Breaking Changes

None - this is a backward-compatible bug fix.

🤖 Generated with Claude Code

Summary by cubic

Fixed double rate limit increment for API key authentication so requests are only counted once, preventing users from burning through their quota too quickly.

  • Bug Fixes
  • Skipped global rate limiting when API key headers are present or after validation.
  • Added a flag to AuthContext to control rate limiting per request.
  • Exposed API key header configuration for accurate detection.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/better-auth/better-auth/pull/4032 **Author:** [@Louis454545](https://github.com/Louis454545) **Created:** 8/15/2025 **Status:** ❌ Closed **Base:** `canary` ← **Head:** `fix/api-key-double-rate-limit-4023` --- ### 📝 Commits (3) - [`d02838d`](https://github.com/better-auth/better-auth/commit/d02838d7c713b6a3b5cc2d315545c3b3e460dee0) fix: prevent double rate-limit increment for API key authentication (#4023) - [`ce7c6bd`](https://github.com/better-auth/better-auth/commit/ce7c6bdea98c1fe69008f9f729b8c8b0dfe3fbbd) security: fix rate limiting bypass vulnerability - [`30354cc`](https://github.com/better-auth/better-auth/commit/30354cc59fbe2b42811253e06de8c65b4466c8db) fix: prevent double rate-limit increment using plugin rate limiter ### 📊 Changes **1 file changed** (+9 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `packages/better-auth/src/plugins/api-key/index.ts` (+9 -0) </details> ### 📄 Description ## Summary Fixes #4023 This PR resolves the double rate-limit increment issue that occurs when authenticating via API key. Previously, both `verifyApiKey()` and `getSession()` would trigger rate limiting independently, causing users to burn through their quota twice as fast. ## Changes Made - **Added `skipGlobalRateLimit` flag to `AuthContext`** - allows components to signal that global rate limiting should be skipped - **Enhanced global rate limiter** - automatically detects API key headers and skips global rate limiting when API keys are present - **Updated API key validation** - sets context flag after successful validation to prevent subsequent rate limiting - **Exposed API key configuration** - allows rate limiter to access plugin's header configuration ## Technical Details The fix works on two levels: 1. **Automatic detection**: When API key headers are present, global rate limiting is automatically skipped since the API key plugin handles its own rate limiting 2. **Context flag**: For explicit `verifyApiKey()` calls, a context flag prevents double rate limiting on subsequent operations ## Test Plan - [x] Verified API key detection logic works correctly for various header configurations - [x] Confirmed type safety for new `skipGlobalRateLimit` property - [x] Tested backward compatibility - non-API key requests continue working normally - [x] Validated that API key rate limiting still functions independently ## Breaking Changes None - this is a backward-compatible bug fix. 🤖 Generated with [Claude Code](https://claude.ai/code) <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Fixed double rate limit increment for API key authentication so requests are only counted once, preventing users from burning through their quota too quickly. - **Bug Fixes** - Skipped global rate limiting when API key headers are present or after validation. - Added a flag to AuthContext to control rate limiting per request. - Exposed API key header configuration for accurate detection. <!-- End of auto-generated description by cubic. --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-03-13 12:12:09 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#5147
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?