Every Bearer API request unnecessarily starts a new PHP session #83

New Issue

2026-09-01T00:07:15-04:00

jared commented

2026-09-01 00:07:15 -04:00

Severity: Low

RateLimitMiddleware::check() calls session_start() unconditionally, before ApiKeyAuth even runs. A Bearer-only client that never sends a session cookie back gets a fresh session ID and a new session file written to session.save_path on every single request, cleaned up only by PHP's own session GC — continuous session-file churn for zero benefit at sustained automation volume (e.g. hwmonDaemon or a triage tool polling frequently). Each response also sends an unnecessary Set-Cookie header on what's meant to be a stateless API. Additionally, since this session_start() runs before AuthMiddleware.php's cookie-hardening (session.cookie_httponly etc.), which Bearer requests never reach, these sessions get whatever cookie defaults are in the server's php.ini rather than the app's hardened settings (unless already hardened at the server-config level).

Fix: Skip session_start() for Bearer-authenticated requests (detect via the Authorization: Bearer header before starting the session), and rate-limit those requests purely by the IP/API-key bucket instead.

**Severity:** Low `RateLimitMiddleware::check()` calls `session_start()` unconditionally, before `ApiKeyAuth` even runs. A Bearer-only client that never sends a session cookie back gets a fresh session ID and a new session file written to `session.save_path` on every single request, cleaned up only by PHP's own session GC — continuous session-file churn for zero benefit at sustained automation volume (e.g. hwmonDaemon or a triage tool polling frequently). Each response also sends an unnecessary `Set-Cookie` header on what's meant to be a stateless API. Additionally, since this `session_start()` runs before `AuthMiddleware.php`'s cookie-hardening (`session.cookie_httponly` etc.), which Bearer requests never reach, these sessions get whatever cookie defaults are in the server's `php.ini` rather than the app's hardened settings (unless already hardened at the server-config level). **Fix:** Skip `session_start()` for Bearer-authenticated requests (detect via the `Authorization: Bearer` header before starting the session), and rate-limit those requests purely by the IP/API-key bucket instead.

jared added the performance priority/low labels 2026-09-08 10:15:48 -04:00

jared referenced this issue from a commit

2026-09-11 14:05:26 -04:00

Overhaul Bearer API rate limiting: real config, per-key isolation, skip session (#80, #81, #82, #83)

jared referenced this issue from a commit

2026-09-11 14:11:51 -04:00

Merge development into main: webhook timeout, comment-edit timeline fix, Bearer rate-limiting overhaul (#77, #80, #81, #82, #83, #87)

jared commented

2026-09-11 14:12:00 -04:00

Fixed and verified (real file-based rate-limit counters, session-file monitoring, real MariaDB, real webhook server). Merged to main in commit aa81739.

Fixed and verified (real file-based rate-limit counters, session-file monitoring, real MariaDB, real webhook server). Merged to main in commit aa81739.

jared closed this issue

2026-09-11 14:12:01 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#83