Skip to content

Disable rate limiter memory fallback in production#387

Open
silentgeckoaudit3801 wants to merge 5 commits into
Quantarq:mainfrom
silentgeckoaudit3801:security/prod-rate-limit-redis-194
Open

Disable rate limiter memory fallback in production#387
silentgeckoaudit3801 wants to merge 5 commits into
Quantarq:mainfrom
silentgeckoaudit3801:security/prod-rate-limit-redis-194

Conversation

@silentgeckoaudit3801

Copy link
Copy Markdown

Closes #194.

Summary

  • configure the module-level SlowAPI limiter with the Redis storage URI instead of leaving storage implicit
  • disable in_memory_fallback_enabled when ENV_VERSION=PROD, while preserving the fallback in development
  • fail production startup by pinging Redis during FastAPI lifespan before serving requests
  • add regression coverage for PROD/DEV fallback policy and startup Redis ping behavior

Validation

  • Parsed the changed Python files with ast.parse using the bundled Codex Python runtime.
  • GitHub compare reports this branch is 0 commits behind main.

Testing

  • Not run as a full local project suite because this workspace is avoiding dependency installation and project toolchain execution.

Comment thread quantara/web_app/tests/test_rate_limiter_prod_fallback.py Fixed
Comment thread quantara/web_app/tests/test_rate_limiter_prod_fallback.py Fixed
Comment thread quantara/web_app/tests/test_rate_limiter_prod_fallback.py Fixed
Comment thread quantara/web_app/tests/test_rate_limiter_prod_fallback.py Fixed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Disable in_memory_fallback in production for the rate limiter

2 participants