') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); feat: Treat rate limit header value as comma-separated list by jnschaeffer · Pull Request #2282 · supabase/auth · GitHub
Skip to content

feat: Treat rate limit header value as comma-separated list - #2282

Merged
jnschaeffer merged 4 commits into
masterfrom
feat/comma-separated-header-keys
Dec 9, 2025
Merged

feat: Treat rate limit header value as comma-separated list#2282
jnschaeffer merged 4 commits into
masterfrom
feat/comma-separated-header-keys

Conversation

@jnschaeffer

@jnschaefferjnschaeffer commented Dec 5, 2025

Copy link
Copy Markdown
Contributor

What kind of change does this PR introduce?

This PR updates performRateLimiting to treat the rate limit header value as a comma-separated list and enforce rate limiting based on the first value in that list.

What is the current behavior?

Certain HTTP headers, such as X-Forwarded-For and other headers that are combined according to RFC 7230, can be represented as a comma-separated list of values. Intermediate proxies may add their own values to these headers, modifying the resulting value. For example, an end user with a single IP address proxied through a fleet of load balancers using the X-Forwarded-For header may be associated with multiple X-Forwarded-For header values, e.g., 2.2.2.2,100.100.100.100 and 2.2.2.2,300.300.300.300. The current implementation of performRateLimiting treats each of these as separate rate limiting keys.

What is the new behavior?

This PR splits the rate limit header by commas and takes the first value (with whitespace removed) to use as the rate limiting key.

Note that this logic is superficially similar to the utilities.GetIPAddress function with two key differences. In performRateLimiting, there is no set format for a given rate limiting key, nor is there a fallback value after the first value in the list that the API should use.

@jnschaeffer
Refactor performRateLimiting with simpler conditional logic
d8d59c9
This commit changes the conditional logic in performRateLimiting to
prefer returning early rather than nesting if/else statements.
This is largely preparation for changing the behavior of
performRateLimiting to accept comma-separated lists of header values,
which will incur some additional conditional logic.
@jnschaeffer
feat: Treat rate limit header value as comma-separated list
8a17b6c
This commit updates performRateLimiting to treat the rate limit header
value as a comma-separated list and enforce rate limiting based on the
first value in that list.
Certain HTTP headers, such as X-Forwarded-For and other headers that
are combined according to RFC 7230, can be represented as a
comma-separated list of values. Intermediate proxies may add their own
values to these headers, modifying the resulting value. For example,
an end user with a single IP address proxied through a fleet of load
balancers using the X-Forwarded-For header may be associated with
multiple X-Forwarded-For header values, e.g.,
"2.2.2.2,100.100.100.100" and "2.2.2.2,300.300.300.300". The current
implementation of performRateLimiting treats each of these as separate
rate limiting keys.
To address this issue, this commit splits the rate limit header by
commas and takes the first value (with whitespace removed) to use as
the rate limiting key.
Note that this logic is superficially similar to the
utilities.GetIPAddress function with two key differences. In
performRateLimiting, there is no set format for a given rate limiting
key, nor is there a fallback value after the first value in the list
that the API should use.
@jnschaeffer
jnschaeffer requested a review from a team as a code ownerDecember 5, 2025 18:10
@coveralls

coveralls commented Dec 5, 2025•
edited
Loading

Copy link
Copy Markdown

Pull Request Test Coverage Report for Build 20066956799

Details

  • 28 of 30(93.33%) changed or added relevant lines in 1 file are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage increased (+0.02%) to 68.471%
Changes Missing CoverageCovered LinesChanged/Added Lines%
internal/api/middleware.go283093.33%
TotalsCoverage Status
Change from base Build 20062718781:0.02%
Covered Lines:14670
Relevant Lines:21425
💛 - Coveralls

fadymak
fadymak reviewed Dec 8, 2025
View reviewed changes

@fadymakfadymak left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice work 👏 Left a couple of small comments/questions whenever you have a moment!

Comment threadinternal/api/middleware.go Outdated
Comment threadinternal/api/middleware.go
@jnschaeffer
Treat an empty first header value as a warning rather than an error
e4f70c0
This commit updates performRateLimiting to emit a warning for headers
that start with a comma rather than return an error.
It is possible under some circumstances that Auth servers could
receive a rate limit header value of the form ", foo". Rather than
break functionality for servers using this, it is safer to instead
emit a warning and then change this to be an error in a future
release.
@jnschaeffer
jnschaeffer enabled auto-merge (squash) December 9, 2025 13:49
@jnschaeffer
jnschaeffer merged commit 5f2e279 into masterDec 9, 2025
6 checks passed
@jnschaeffer
jnschaeffer deleted the feat/comma-separated-header-keys branch December 9, 2025 15:50
@github-actionsgithub-actionsBot mentioned this pull request Dec 9, 2025
Merged
hf added a commit that referenced this pull request Jan 12, 2026
@hf
Revert "feat: Treat rate limit header value as comma-separated list (#…
d8c5dc6
…2282)"
This reverts commit 5f2e279.
@hfhf mentioned this pull request Jan 12, 2026
Merged
cemalkilic pushed a commit that referenced this pull request Jan 12, 2026
@hf@depthfirst-app
feat: reset main branch to 2.185.0 (#2325)
b9d0500
Resets the main branch (`master`) to have the same changeset as 2.184.0
but under 2.185.0.
Original release please notes:
### Features
* Add Sb-Forwarded-For header and IP-based rate limiting
([#2295](#2295))
([e8f679b](e8f679b))
* allow amr claim to be array of strings or objects
([#2274](#2274))
([607da43](607da43))
* Treat rate limit header value as comma-separated list
([#2282](#2282))
([5f2e279](5f2e279))
### Bug Fixes
* check each type independently
([#2290](#2290))
([d9de0af](d9de0af))
* fix the wrong error return value
([#1950](#1950))
([e2dfb5d](e2dfb5d))
* **indexworker:** remove pg_trgm extension
([#2301](#2301))
([c553b10](c553b10))
* **oauth-server:** allow custom URI schemes in client redirect URIs
([#2298](#2298))
([ea72f57](ea72f57))
* tighten email validation rules
([#2304](#2304))
([33bb372](33bb372))
---------
Co-authored-by: depthfirst-app[bot] <184448029+depthfirst-app[bot]@users.noreply.github.com>
cemalkilic pushed a commit that referenced this pull request Jan 12, 2026
@github-actions
chore(master): release 2.185.0 (#2287)
711763c
🤖 I have created a release *beep* *boop*
---
##
[2.185.0](v2.184.0...v2.185.0)
(2026-01-12)
### Features
* Add Sb-Forwarded-For header and IP-based rate limiting
([#2295](#2295))
([e8f679b](e8f679b))
* allow amr claim to be array of strings or objects
([#2274](#2274))
([607da43](607da43))
* reset main branch to 2.185.0
([#2325](#2325))
([b9d0500](b9d0500))
* Treat rate limit header value as comma-separated list
([#2282](#2282))
([5f2e279](5f2e279))
### Bug Fixes
* additional provider and issuer checks
([#2326](#2326))
([cb79a74](cb79a74))
* check each type independently
([#2290](#2290))
([d9de0af](d9de0af))
* fix the wrong error return value
([#1950](#1950))
([e2dfb5d](e2dfb5d))
* **indexworker:** remove pg_trgm extension
([#2301](#2301))
([c553b10](c553b10))
* **oauth-server:** allow custom URI schemes in client redirect URIs
([#2298](#2298))
([ea72f57](ea72f57))
* tighten email validation rules
([#2304](#2304))
([33bb372](33bb372))
---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@cemalkiliccemalkilic mentioned this pull request Jan 21, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fadymakfadymakfadymak approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jnschaeffer@coveralls@fadymak