security: add rate limiting to admin action endpoints #12

New issue

Closed

opened 2026-02-20 02:38:40 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 02:38:40 +00:00

Member

Issue

Admin modal endpoints lack rate limiting, allowing unlimited sensitive operations.

Affected Components

PlatformUser.php

Unlimited operations:

Tier changes (saveTier())
User deletions
Entitlement provisioning/deprovisioning
Verification status changes
User data exports

Risk:

Compromised admin account could rapidly modify all users
No throttling on bulk operations
Potential for automated abuse

Settings.php

Unlimited operations:

Profile updates
Password changes
Account deletion requests

Risk:

Brute force attempts if session compromised
Rapid account deletion request spam

WaitlistManager.php

Unlimited operations:

Waitlist exports (potentially large datasets)

Risk:

Resource exhaustion via repeated exports
Data exfiltration if compromised

Recommended Limits

Tier changes: 10/minute per admin
Profile updates: 20/minute per user
Password changes: 5/minute per user
Data exports: 5/minute per admin
Deletion requests: 3/minute per user

Testing Requirements

Test rate limit enforcement
Test rate limit reset after window
Test rate limit bypass for superadmin (if needed)
Test user feedback when rate limited

Priority

High - Security best practice for admin panels.

Discovered by

Automatic codebase scan (issue #3)

## Issue Admin modal endpoints lack rate limiting, allowing unlimited sensitive operations. ## Affected Components ### PlatformUser.php **Unlimited operations:** - Tier changes (`saveTier()`) - User deletions - Entitlement provisioning/deprovisioning - Verification status changes - User data exports **Risk:** - Compromised admin account could rapidly modify all users - No throttling on bulk operations - Potential for automated abuse ### Settings.php **Unlimited operations:** - Profile updates - Password changes - Account deletion requests **Risk:** - Brute force attempts if session compromised - Rapid account deletion request spam ### WaitlistManager.php **Unlimited operations:** - Waitlist exports (potentially large datasets) **Risk:** - Resource exhaustion via repeated exports - Data exfiltration if compromised ## Recommended Solution ### Laravel Rate Limiting Add rate limiters in `RouteServiceProvider`: ```php RateLimiter::for('admin-mutations', function (Request $request) { return Limit::perMinute(20)->by($request->user()->id); }); RateLimiter::for('admin-exports', function (Request $request) { return Limit::perMinute(5)->by($request->user()->id); }); ``` Apply to routes: ```php Route::middleware(['auth', 'throttle:admin-mutations']) ->group(function () { // Admin mutation routes }); ``` ### Livewire Component Rate Limiting Alternatively, add to component methods: ```php public function saveTier(): void { RateLimiter::attempt( 'tier-change:' . $this->user()->id, $perMinute = 10, function() { // Tier change logic }, $decaySeconds = 60 ); } ``` ## Recommended Limits - **Tier changes:** 10/minute per admin - **Profile updates:** 20/minute per user - **Password changes:** 5/minute per user - **Data exports:** 5/minute per admin - **Deletion requests:** 3/minute per user ## Testing Requirements - Test rate limit enforcement - Test rate limit reset after window - Test rate limit bypass for superadmin (if needed) - Test user feedback when rate limited ## Priority **High** - Security best practice for admin panels. ## Discovered by Automatic codebase scan (issue #3)