キー生成は検証済みのセッションを使おう

Author: Ojoxux

app/server/lib/rate-limit.test.ts

@@ -4,6 +4,7 @@ import { env } from "cloudflare:test";
 import type { HonoContext } from "../../types/env";
 import { rateLimiter } from "./rate-limit";
 import { errorHandler } from "./errors";
+import { createSession } from "./session";
 
 describe("rateLimiter middleware", () => {
   const errorSpy = vi.spyOn(console, "error");
@@ -57,7 +58,8 @@ describe("rateLimiter middleware", () => {
     expect(errorSpy).toHaveBeenCalled();
   });
 
-  it("should prefer a session identifier over an IP address", async () => {
+  it("should prefer a validated session's user id over an IP address", async () => {
+    const sessionId = await createSession(env.KV, "user-123");
     const limit = vi.fn<RateLimit["limit"]>().mockResolvedValue({ success: true });
     const app = new Hono<HonoContext>();
     app.use(
@@ -74,13 +76,40 @@ describe("rateLimiter middleware", () => {
       "/limited",
       {
         headers: {
-          Cookie: "session_id=test-session",
+          Cookie: `session_id=${sessionId}`,
           "CF-Connecting-IP": "1.1.1.1",
         },
       },
       { ...env, API_RATE_LIMITER: { limit } },
     );
 
-    expect(limit).toHaveBeenCalledWith({ key: "session:test-session" });
+    expect(limit).toHaveBeenCalledWith({ key: "user:user-123" });
+  });
+
+  it("should fall back to an IP address when the session cookie is forged", async () => {
+    const limit = vi.fn<RateLimit["limit"]>().mockResolvedValue({ success: true });
+    const app = new Hono<HonoContext>();
+    app.use(
+      "*",
+      rateLimiter({
+        binding: "API_RATE_LIMITER",
+        limit: 60,
+        period: 60,
+      }),
+    );
+    app.get("/limited", (c) => c.json({ ok: true }));
+
+    await app.request(
+      "/limited",
+      {
+        headers: {
+          Cookie: "session_id=attacker-controlled-value",
+          "CF-Connecting-IP": "1.1.1.1",
+        },
+      },
+      { ...env, API_RATE_LIMITER: { limit } },
+    );
+
+    expect(limit).toHaveBeenCalledWith({ key: "ip:1.1.1.1" });
   });
 });

app/server/lib/rate-limit.ts

@@ -2,6 +2,7 @@ import type { Context, MiddlewareHandler, Next } from "hono";
 import { getCookie } from "hono/cookie";
 import type { HonoContext } from "../../types/env";
 import { RateLimitError } from "./errors";
+import { validateSession } from "./session";
 
 interface RateLimitConfig {
   /** Wranglerで設定したRate Limiting binding名 */
@@ -10,8 +11,8 @@ interface RateLimitConfig {
   limit: number;
   /** ウィンドウサイズ（秒） */
   period: 10 | 60;
-  /** キー生成関数（デフォルト: セッションID、未認証時はIPアドレス） */
-  keyGenerator?: (c: Context<HonoContext>) => string;
+  /** キー生成関数（デフォルト: 検証済みユーザーID、未認証時はIPアドレス） */
+  keyGenerator?: (c: Context<HonoContext>) => string | Promise<string>;
 }
 
 /**
@@ -22,7 +23,8 @@ export function rateLimiter(config: RateLimitConfig): MiddlewareHandler<HonoCont
 
   return async (c: Context<HonoContext>, next: Next) => {
     const rateLimit = c.env[binding];
-    const { success } = await rateLimit.limit({ key: keyGenerator(c) });
+    const key = await keyGenerator(c);
+    const { success } = await rateLimit.limit({ key });
 
     c.header("X-RateLimit-Limit", String(limit));
 
@@ -37,11 +39,20 @@ export function rateLimiter(config: RateLimitConfig): MiddlewareHandler<HonoCont
 
 /**
  * デフォルトのキー生成関数
+ *
+ * session_idクッキーはクライアントが自由に設定できるため、
+ * 生の値をキーに使うとレート制限を回避できてしまう。
+ * 必ずKVで検証し、検証済みのユーザーIDのみをキーに採用する。
  */
-function defaultKeyGenerator(c: Context<HonoContext>): string {
+async function defaultKeyGenerator(c: Context<HonoContext>): Promise<string> {
   const sessionId = getCookie(c, "session_id");
   if (sessionId) {
-    return `session:${sessionId}`;
+    try {
+      const userId = await validateSession(c.env.KV, sessionId);
+      return `user:${userId}`;
+    } catch {
+      // 無効・期限切れのセッションはIPアドレスにフォールバック
+    }
   }
 
   const ip =
@@ -56,7 +67,7 @@ function defaultKeyGenerator(c: Context<HonoContext>): string {
 /**
  * 認証済みユーザーのキー生成関数
  */
-function authenticatedUserKeyGenerator(c: Context<HonoContext>): string {
+async function authenticatedUserKeyGenerator(c: Context<HonoContext>): Promise<string> {
   const userId = c.get("userId");
   return userId ? `user:${userId}` : defaultKeyGenerator(c);
 }