[A-05] `/api/games/import` and `/api/games/search` allow anonymous calls #41

New issue

Closed

opened 2026-10-11 20:15:34 -05:00 by pyaniz · 1 comment

pyaniz commented

2026-10-11 20:15:34 -05:00

Owner

Audit ID: A-05 · Priority: P1 · Effort: S

/api/games/import and /api/games/search allow anonymous calls. import uses get_current_user_optional, so anyone can trigger BGG fetches and DB writes, and search has no auth at all. This is an abuse and quota risk against BGG. The @router.post("/import") decorator is also duplicated (games/router.py:493-494).

Source: AUDIT_FINDINGS.md (audit 2026-10-11). Items marked (verify) need confirming first.

**Audit ID:** A-05 · **Priority:** P1 · **Effort:** S **`/api/games/import` and `/api/games/search` allow anonymous calls.** `import` uses `get_current_user_optional`, so anyone can trigger BGG fetches and DB writes, and `search` has no auth at all. This is an abuse and quota risk against BGG. The `@router.post("/import")` decorator is also duplicated (`games/router.py:493-494`). Source: `AUDIT_FINDINGS.md` (audit 2026-10-11). Items marked *(verify)* need confirming first.

pyaniz added the

audit

security

labels

2026-10-11 20:15:34 -05:00

pyaniz commented

2026-10-11 20:36:56 -05:00

Author

Owner

Added per-IP rate limits (30/min search, 20/min import), a 100-char query cap and removed the duplicate decorator. Anonymous access is kept on purpose: anonymous groups use the game picker, so requiring login would break them. Limits are in-memory per instance (best effort on serverless). Commit 3df042e on staging (VERSION 1.28.6).

pyaniz closed this issue

2026-10-11 20:39:54 -05:00

pyaniz referenced this issue from a commit

2026-10-18 11:06:33 -05:00

Rate-limit BGG endpoints, refresh README and install docs (#41, #49, #50)