Surfaced during the review of #797 (pre-existing, not introduced there). The auth middleware is outermost in the chain, so requests rejected with 401 never reach the rate limiter — Bearer-token guessing against /api/* is effectively unmetered. #797's wrapMiddleware centralization (web/server.go) makes the ordering explicit in one place, which is also where a fix would go: count requests before (or independently of) auth rejection, or add a dedicated limiter for 401s. Needs a decision on desired semantics (per-IP counting of unauthenticated attempts vs. current behavior) before a patch.
Assisted by claude-code:claude-fable-5 — Session
Surfaced during the review of #797 (pre-existing, not introduced there). The auth middleware is outermost in the chain, so requests rejected with 401 never reach the rate limiter — Bearer-token guessing against
/api/*is effectively unmetered. #797'swrapMiddlewarecentralization (web/server.go) makes the ordering explicit in one place, which is also where a fix would go: count requests before (or independently of) auth rejection, or add a dedicated limiter for 401s. Needs a decision on desired semantics (per-IP counting of unauthenticated attempts vs. current behavior) before a patch.Assisted by claude-code:claude-fable-5 — Session