fix(preview): rate limit anonymous proxy previews per client

[polylane]

Fixes: cache-app /api/preview is an unauthenticated media proxy that can stream 200 MB per request with no rate limit

The preview endpoint streams upstream media through the app origin, and nothing stopped an anonymous client from pulling fresh URLs without limit, so a burst of requests could exhaust the deployment's bandwidth budget and pause the app. Proxy previews now pass a per-client request budget before any upstream fetch, and callers over the budget receive a too-many-requests response.

flowchart LR
  C["anonymous client"] -->|"GET /api/preview delivery=proxy"| R["route GET"]
  R -->|"per-client budget (new)"| A["Arcjet ArcjetFixedWindow IP"]
  A -->|"denied"| X["too many requests"]
  A -->|"allowed or key unset"| F["upstream fetch and stream"]
  F -->|"up to 10 MB image / 200 MB video"| O["Vercel origin egress"]

Loading

What caused this

Affected: int_0b563423d00164u048hh0syk

Why this fix

The read of app/api/preview/route.ts confirmed the finding's harmful behavior: the GET handler fetches a caller-supplied URL for image and video previews with no session check (only the Google Photos branch reads the session), the middleware matcher excludes /api/, and nothing throttles the route. The proxy delivery streams the upstream response through the Vercel origin, so an anonymous client can drive origin egress by requesting fresh URLs; a hot URL is cheap because the CDN serves it, but every miss is a full fetch. The same read shows the egress boundary itself is sound (pinned-address fetch, fail-closed SSRF checks), so this is a cost/abuse lever rather than an SSRF hole. Bandwidth is what pauses this deployment, and the workspace has no monitor or readable request series that would show it happening.

The change bounds that lever at the request boundary with the repository's designated rate limiter, keyed per client and applied before any cache lookup or upstream fetch, so an over-limit caller is turned away without spending bandwidth. Cached, CDN-served, and redirect responses are unaffected, and the authenticated Google Photos branch is exempt.

Recorded as remaining work on the issue timeline, not fixed here: the 200 MB video cap and off-origin video delivery, the unthrottled delivery=redirect resolution path, the control's fail-open behavior when Arcjet is unreachable, and the separately filed plan and monitoring gaps. Until those land, a determined client can still move real bandwidth within the per-client allowance, and a plan-driven pause would still be discovered by users rather than the team.

Out of scope

• The 200 MB video response cap and moving video delivery off the app origin.
• The delivery=redirect path, which does not stream origin bytes but still triggers outbound resolution with no limit.
• The Vercel plan and bandwidth/uptime monitoring, tracked by separate issues.

Causal chain

• Signal (alert): cache-app /api/preview is an unauthenticated media proxy that can stream 200 MB per request with no rate limit
• Surfacing site: prj_AHMEAICxXeBeqeJlZouvveAto2wo at gilsmt/cache-app:app/api/preview/route.ts#GET
• Mechanism: GET /api/preview with delivery=proxy performs a server-side fetch of a caller-supplied URL and streams the upstream bytes (up to 10 MB image, 200 MB video) through the Vercel origin. The image and video branches read no session, proxy.ts excludes /api/ from the auth middleware, and no rate limit exists on the request path, so any anonymous client can drive unbounded origin egress.
• Producer: cache-app /api/preview GET handler, at gilsmt/cache-app:app/api/preview/route.ts#GET
• What happens to the failed unit today: No rate limit existed on the request path; the video path's only gate was a Cobalt host allowlist, not a budget.
• Blast radius: unknown other resource(s), unknown other tenant(s); data at risk: none named
• Producer evidence:
  • GET parsed url/delivery/type and fetched with no session check; getSessionUserId was read only in serveGooglePhotosPreview (401 when absent)
  • proxy.ts matcher excluded api/, so the route owned its own authorization and had none
  • lib/intelligence/protection.ts applied Arcjet only to Gen AI requests; nothing throttled /api/preview

1 file changed (+29/-0)

• app/api/preview/route.ts: modified, +29/-0

---

Generated by Polylane. You can ask follow-ups by mentioning @polylane in a comment.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: fd59380e-5443-4748-ab2d-195b0a239349

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cache-app	Ready	Preview	Sep 20, 2026 7:46pm UTC

[polylane]

Gilberto closed this pull request from Polylane:

Planned