Documentation Index

Fetch the complete documentation index at: https://docs.crewship.ai/llms.txt

Use this file to discover all available pages before exploring further.

​

Rate Limiting & Security Headers

• internal/api/middleware.go — SecurityHeaders.
• internal/api/ratelimit.go — RateLimiter, extractIP.
• internal/api/router.go — middleware composition and route buckets.
• internal/api/auth_google.go + internal/api/oauth.go — OAuth state lifecycle.

​

Security response headers

​

Path-aware CSP

​

Per-IP rate limiting

// Skip rate limiting for internal routes (sidecar IPC, X-Internal-Token auth)
if strings.HasPrefix(path, "/api/v1/internal/") { r.mux.ServeHTTP(w, req); return }
if strings.HasPrefix(path, "/api/auth/") || … { r.authRateLimitedMux.ServeHTTP(…); return }
if strings.HasPrefix(path, "/api/")          { r.apiRateLimitedMux.ServeHTTP(…);  return }
r.mux.ServeHTTP(w, req)

​

Burst, cleanup, 429 response

• Bucket burst equals the per-minute limit (full bucket on first visit).
• Stale per-IP entries are swept every 3 minutes; anything not seen in the last 5 minutes is evicted.
• Exceeding the bucket returns:
  HTTP/1.1 429 Too Many Requests
  Retry-After: 60
  Content-Type: application/json
  
  {"error": "Too many requests"}
  

​

IP extraction

1. X-Forwarded-For — split on comma, only the first entry is used. If the header is 1.2.3.4, 10.0.0.1, the client IP is 1.2.3.4.
2. X-Real-IP — used if X-Forwarded-For is absent.
3. r.RemoteAddr (host portion) — final fallback.

​

OAuth CSRF state

• Single-use — the callback uses DELETE … RETURNING to read and remove the row in one statement. A replayed ?state=… returns 400 Invalid or expired state.
• 15-minute expiry — the callback rejects any state whose created_at is older than 15 minutes with 400 OAuth state expired. The OAuth connector flow also sweeps expired rows on each new request (DELETE FROM oauth_states WHERE created_at < datetime('now', '-15 minutes')).
• Fail closed on parse error — unreadable timestamps are treated as invalid rather than allowed through.
• PKCE — the credential-connector flow additionally stores a PKCE code_verifier alongside the state for the token-exchange step.
• Safe redirect allowlist — Google sign-in passes the caller’s ?redirect= through isSafeRedirect before storing, so a bad actor cannot smuggle in an open-redirect target via the state row.

​

State lifecycle

POST /api/auth/google/start
  → generate 16 random bytes, base64url-encode
  → INSERT INTO oauth_states (state, redirect_uri, [code_verifier])
  → 307 redirect to provider with ?state=<token>

GET /api/auth/google/callback?state=<token>&code=<code>
  → DELETE FROM oauth_states WHERE state = ? RETURNING redirect_uri, created_at
  → if row missing              → 400 Invalid or expired state
  → if created_at > 15 min ago  → 400 OAuth state expired
  → otherwise exchange code and sign the user in

​

Reviewing behaviour in practice

​

See also

• RBAC — role-gated authorisation layered on top of these controls.
• Encryption — credential + memory at-rest protection.