Security: harden tile proxy against third-party abuse (#204)#205

Merged

stef-k merged 18 commits intomainfrom

feature/harden-tile-proxy-204

Mar 22, 2026

Commits on Mar 22, 2026

WIP: sliding-window rate limiter + security headers (checkpoint)
stef-k
committed
WIP: authenticated user rate limiting + migration (checkpoint)
stef-k
committed
WIP: outbound request budget for OSM protection (checkpoint)
stef-k
committed
Security: harden tile proxy with sliding-window rate limiter, outbound budget, and auth rate limits (#204)
stef-k
committed
Fix all review findings: admin UI, OSM compliance, concurrency, usability
stef-k
committed
Fix checkbox unchecking in admin settings (hidden field fallback)
stef-k
committed
Update CHANGELOG with checkbox fix entry
stef-k
committed
Fix review findings: eviction atomicity, per-cache cleanup, background sweep, concurrency
stef-k
committed
Fix review pass 2: lock contention, cold-cache latency, eviction races, scoping, retry
stef-k
committed
Fix review pass 3: lock contention, purge ordering, budget retries, test robustness
stef-k
committed
Fix review pass 4: eviction concurrency, purge ordering, orphan query, entity tracking
stef-k
committed
Fix review pass 5: PurgeBatchAsync cache size drift for zoom 0-8 tiles
stef-k
committed
Fix review pass 6: purge retry safety, sliding-window accuracy, concurrency guards
stef-k
committed
Fix review pass 7: index, purge perf, lock convoy, budget timeout, rate limit hardening
stef-k
committed
Fix review pass 8: per-IP outbound budget, IPv6 normalization, purge drift, revalidation cancellation
stef-k
committed
Fix review pass 9: purge robustness, lock chunking, DI safety, per-IP revalidation budget
stef-k
committed
Fix review pass 10: concurrent insert race, purge memory, retry safety
stef-k
committed
Fix review pass 11: add missing ProxyImageRateLimitEnabled to admin UI
stef-k
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security: harden tile proxy against third-party abuse (#204)#205

Security: harden tile proxy against third-party abuse (#204)#205
stef-k merged 18 commits intomainfrom
feature/harden-tile-proxy-204

Commits on Mar 22, 2026

WIP: sliding-window rate limiter + security headers (checkpoint)

WIP: authenticated user rate limiting + migration (checkpoint)

WIP: outbound request budget for OSM protection (checkpoint)

Security: harden tile proxy with sliding-window rate limiter, outbound budget, and auth rate limits (#204)

Fix all review findings: admin UI, OSM compliance, concurrency, usability

Fix checkbox unchecking in admin settings (hidden field fallback)

Update CHANGELOG with checkbox fix entry

Fix review findings: eviction atomicity, per-cache cleanup, background sweep, concurrency

Fix review pass 2: lock contention, cold-cache latency, eviction races, scoping, retry

Fix review pass 3: lock contention, purge ordering, budget retries, test robustness

Fix review pass 4: eviction concurrency, purge ordering, orphan query, entity tracking

Fix review pass 5: PurgeBatchAsync cache size drift for zoom 0-8 tiles

Fix review pass 6: purge retry safety, sliding-window accuracy, concurrency guards

Fix review pass 7: index, purge perf, lock convoy, budget timeout, rate limit hardening

Fix review pass 8: per-IP outbound budget, IPv6 normalization, purge drift, revalidation cancellation

Fix review pass 9: purge robustness, lock chunking, DI safety, per-IP revalidation budget

Fix review pass 10: concurrent insert race, purge memory, retry safety

Fix review pass 11: add missing ProxyImageRateLimitEnabled to admin UI