Skip to content

feat: Implement strict IoT payload security, validation, and rate limiting#49

Merged
GiZano merged 2 commits intomainfrom
Backend
Apr 18, 2026
Merged

feat: Implement strict IoT payload security, validation, and rate limiting#49
GiZano merged 2 commits intomainfrom
Backend

Conversation

@GiZano
Copy link
Copy Markdown
Owner

@GiZano GiZano commented Apr 18, 2026

Description

This PR resolves the critical security vulnerabilities outlined in Issue #19. It introduces a Defense in Depth strategy to the FastAPI backend to protect against spoofed seismic data, replay attacks, and database saturation (DoS).

Changes Proposed

Related Issues

Testing Performed

  • Verified that requests missing the X-API-Key return a 401 Unauthorized.
  • Verified that sending a value outside the -8192 to 8192 range returns a 422 Unprocessable Entity.
  • Stress-tested the endpoint to confirm that exceeding 50 req/sec from a single IP triggers a 429 Too Many Requests.
  • Ensured public routes (/docs, /ws) remain accessible without API keys.

GiZano added 2 commits April 18, 2026 17:16
- Added global API Key middleware to block unauthorized devices (#20).
- Applied strict mathematical bounds to sensor data schemas (#21).
- Implemented Redis-based IP rate limiting on ingestion endpoints (#22).

Resolves #19
- Replaced the silent `pass` in the WebSocket broadcast exception handler.
- Added error logging to capture failed client transmissions.
- Implemented cleanup logic to identify and remove dead WebSocket connections from the active list.
- Resolves Bandit security warning B110 (try_except_pass).
@GiZano GiZano merged commit 18f9c62 into main Apr 18, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant