Skip to content

[Backend] backend/src/controllers/sse.controller.ts does not cap the total number of concurrent SSE subscriptions per authenticated user across multiple streams #1115

Description

@grantfox-oss

Join our community: https://t.me/+DOylgFv1jyJlNzM0

Why this matters

sse.service.ts has a per-IP connection limit (MAX_PER_IP, already flagged elsewhere as env-configurable) but that's IP-scoped, not user-scoped. An authenticated user behind NAT or using multiple devices/tabs could still open an unbounded number of SSE subscriptions across different streams, each held open by the same account, contributing to file-descriptor exhaustion on the server that per-IP limiting alone doesn't fully prevent.

Acceptance criteria

  • Add a per-authenticated-user cap on concurrent SSE subscriptions, independent of IP
  • Return a clear error (e.g. 429) when the cap is exceeded
  • Add a test covering the per-user cap

Files to touch

  • backend/src/controllers/sse.controller.ts
  • backend/src/services/sse.service.ts

Out of scope

  • Changing the existing per-IP limit (tracked separately)
  • Building a full connection-quota dashboard

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programbackendBackend related taskssecuritySecurity related tasks

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions