Require authentication for RPCs and rate-limit fan-out methods #5

2026-09-25T18:04:27Z

selimaj-dev commented

2026-09-25 18:04:27 +00:00

Every method except auth_challenge/auth_verify now requires a verified
session (auth::require) and answers "Not authenticated" otherwise.
Before, an unauthenticated connection could send emote_event
notifications to any connected player and probe who is online with
get_player.
Rate-limit per connection the methods that fan out to other players:
emote (burst 5, +1/s) and send_player (burst 10, +1/s).
Cap emote/send_player targets at 256 and de-duplicate them.
Default SUPPORTED_VERSIONS to 0.1.1-beta.

Co-Authored-By: Claude Opus 5.5 [email protected]

- Every method except auth_challenge/auth_verify now requires a verified session (auth::require) and answers "Not authenticated" otherwise. Before, an unauthenticated connection could send emote_event notifications to any connected player and probe who is online with get_player. - Rate-limit per connection the methods that fan out to other players: emote (burst 5, +1/s) and send_player (burst 10, +1/s). - Cap emote/send_player targets at 256 and de-duplicate them. - Default SUPPORTED_VERSIONS to 0.1.1-beta. Co-Authored-By: Claude Opus 5.5 <[email protected]>

selimaj-dev added 1 commit 2026-09-25 18:04:27 +00:00

Require authentication for RPCs and rate-limit fan-out methods 56f511d5f6

- Every method except auth_challenge/auth_verify now requires a verified
  session (auth::require) and answers "Not authenticated" otherwise.
  Before, an unauthenticated connection could send emote_event
  notifications to any connected player and probe who is online with
  get_player.
- Rate-limit per connection the methods that fan out to other players:
  emote (burst 5, +1/s) and send_player (burst 10, +1/s).
- Cap emote/send_player targets at 256 and de-duplicate them.
- Default SUPPORTED_VERSIONS to 0.1.1-beta.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

selimaj-dev merged commit 0179da4bbf into master

2026-09-25 18:04:31 +00:00

selimaj-dev deleted branch harden-rpc

2026-09-25 18:04:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: saturnclientmc/server#5