Skip to content

chore: add rate limiting to github webhook endpoint#167

Open
shivampilania07 wants to merge 1 commit into
Coder-s-OG-s:mainfrom
shivampilania07:fix/github-webhook-rate-limit
Open

chore: add rate limiting to github webhook endpoint#167
shivampilania07 wants to merge 1 commit into
Coder-s-OG-s:mainfrom
shivampilania07:fix/github-webhook-rate-limit

Conversation

@shivampilania07
Copy link
Copy Markdown

Summary

Adds IP-based rate limiting to the GitHub webhook endpoint to prevent abuse and protect the Inngest queue from spam or excessive requests.

Type of Change

  • Security improvement
  • Bug fix

Related Issue

Closes #160

What was changed?

  • Extracted client IP from request headers (x-forwarded-for / x-real-ip)
  • Added rate limiting using existing rateLimit utility
  • Applied limit: 100 requests per 60 seconds per IP
  • Ensured rate limiting runs before signature verification and webhook processing
  • No changes made to existing webhook logic or signature verification

Screenshots

Not applicable (backend change)

Checklist

  • My code follows the project structure and conventions
  • I tested this locally (npm run dev)
  • No hardcoded secrets or credentials
  • I have updated documentation if needed

@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented May 18, 2026

Someone is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel.

A member of the Team first needs to authorize it.

Copy link
Copy Markdown
Collaborator

@Ayush-Patel-56 Ayush-Patel-56 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The title of this pull request is "chore: add rate limiting to github webhook endpoint", but the actual code change shown in the diff only adds configuration for line endings (.gitattributes). There is no actual rate-limiting code included in this file change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Webhook endpoint has no rate limiting

2 participants