Require authentication for RPCs and rate-limit fan-out methods #5

Merged

selimaj-dev merged 1 commits from harden-rpc into master

2026-09-25 18:04:31 +00:00

Author	SHA1	Message	Date
selimaj-devandclaude	56f511d5f6	Require authentication for RPCs and rate-limit fan-out methods - Every method except auth_challenge/auth_verify now requires a verified session (auth::require) and answers "Not authenticated" otherwise. Before, an unauthenticated connection could send emote_event notifications to any connected player and probe who is online with get_player. - Rate-limit per connection the methods that fan out to other players: emote (burst 5, +1/s) and send_player (burst 10, +1/s). - Cap emote/send_player targets at 256 and de-duplicate them. - Default SUPPORTED_VERSIONS to 0.1.1-beta. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-09-25 19:56:44 +02:00

Author

SHA1

Message

Date

selimaj-devandclaude

56f511d5f6

Require authentication for RPCs and rate-limit fan-out methods

- Every method except auth_challenge/auth_verify now requires a verified
  session (auth::require) and answers "Not authenticated" otherwise.
  Before, an unauthenticated connection could send emote_event
  notifications to any connected player and probe who is online with
  get_player.
- Rate-limit per connection the methods that fan out to other players:
  emote (burst 5, +1/s) and send_player (burst 10, +1/s).
- Cap emote/send_player targets at 256 and de-duplicate them.
- Default SUPPORTED_VERSIONS to 0.1.1-beta.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-09-25 19:56:44 +02:00