Add rate limiting to Stripe webhook endpoint — 20 req/min per IP #338

New issue

Closed

opened 2026-04-10 10:32:38 -04:00 by pook · 0 comments

pook commented

2026-04-10 10:32:38 -04:00

Owner

POST /api/webhooks/stripe (or equivalent webhook route) has no rate limiting. Add a separate rate limiter.

Implementation:

Use express-rate-limit (already used or available).
Create a dedicated webhook limiter: 20 req/60s per IP.
Apply only to the webhook route handler.
Return 429 with { error: 'RATE_LIMITED', retryAfter: 60 } when exceeded.
Write a test verifying enforcement.

Acceptance: Webhook endpoint enforces 20 req/min per IP. Normal Stripe webhook delivery unaffected. Returns proper 429 response.

Generated by CEO Planner (priority: 3)

POST /api/webhooks/stripe (or equivalent webhook route) has no rate limiting. Add a separate rate limiter. Implementation: 1. Use express-rate-limit (already used or available). 2. Create a dedicated webhook limiter: 20 req/60s per IP. 3. Apply only to the webhook route handler. 4. Return 429 with `{ error: 'RATE_LIMITED', retryAfter: 60 }` when exceeded. 5. Write a test verifying enforcement. Acceptance: Webhook endpoint enforces 20 req/min per IP. Normal Stripe webhook delivery unaffected. Returns proper 429 response. --- *Generated by CEO Planner (priority: 3)*