Fix security issues in events endpoint: add authentication and fix memory leak

Jeevan-ZGDX · Jeevan-ZGDX · commit 682fbebaf280 · 2026-04-02T09:33:16.000+05:30
diff --git a/src/gateway/server-http.ts b/src/gateway/server-http.ts
@@ -505,6 +505,7 @@ export function createGatewayHttpServer(opts: {
       }
       if (
         await handleEventsHttpRequest(req, res, {
+          auth: resolvedAuth,
           trustedProxies,
           allowRealIpFallback,
         })
diff --git a/src/gateway/server/events-http.ts b/src/gateway/server/events-http.ts
@@ -1,9 +1,12 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
+import type { ResolvedGatewayAuth } from "../server/auth.js";
+import { authorizeGatewayHttpRequestOrReply } from "../server/auth.js";
 import { setSseHeaders, sendJson, sendMethodNotAllowed } from "../http-common.js";
 import { readJsonBody } from "../hooks.js";
 import { resolveClientIp } from "../net.js";
 
 type EventsHttpOptions = {
+  auth: ResolvedGatewayAuth;
   trustedProxies?: string[];
   allowRealIpFallback?: boolean;
 };
@@ -163,15 +166,30 @@ function checkRateLimit(ip: string): { allowed: boolean; retryAfter?: number } {
     return { allowed: false, retryAfter: Math.max(1, Math.ceil(retryAfterMs / 1000)) };
   }
   recent.push(now);
-  rateLimitTimestamps.set(ip, recent);
+  if (recent.length === 0) {
+    rateLimitTimestamps.delete(ip);
+  } else {
+    rateLimitTimestamps.set(ip, recent);
+  }
   return { allowed: true };
 }
 
 export async function handleEventsHttpRequest(
   req: IncomingMessage,
   res: ServerResponse,
-  opts: EventsHttpOptions = {},
+  opts: EventsHttpOptions,
 ): Promise<boolean> {
+  const requestAuth = await authorizeGatewayHttpRequestOrReply({
+    req,
+    res,
+    auth: opts.auth,
+    trustedProxies: opts.trustedProxies,
+    allowRealIpFallback: opts.allowRealIpFallback,
+  });
+  if (!requestAuth) {
+    return true;
+  }
+
   const url = new URL(req.url ?? "/", `http://${req.headers.host || "localhost"}`);
   const pathname = url.pathname;
 

Original file line number	Diff line number	Diff line change
`@@ -505,6 +505,7 @@ export function createGatewayHttpServer(opts: {`
`505`	`505`	`}`
`506`	`506`	`if (`
`507`	`507`	`await handleEventsHttpRequest(req, res, {`
	`508`	`+ auth: resolvedAuth,`
`508`	`509`	`trustedProxies,`
`509`	`510`	`allowRealIpFallback,`
`510`	`511`	`})`