CRE Gateway: Checks on json request id size to prevent abuse by prashantkumar1982 · Pull Request #21019 · smartcontractkit/chainlink

prashantkumar1982 · 2026-02-03T22:54:35Z

Put a fixed size limit on json request id in gateway, to prevent abuses.
Vault Get public key endpoint is unauthenticated, so made its fetching of cached entries efficient and cheap, to prevent potential dos.

… into vault_reqid_check

github-actions · 2026-02-03T22:55:41Z

I see you updated files related to core. Please run pnpm changeset in the root directory to add a changeset as well as in the text include at least one of the following tags:

#added For any new functionality added.
#breaking_change For any functionality that requires manual action for the node to boot.
#bugfix For bug fixes.
#changed For any change to the existing functionality.
#db_update For any feature that introduces updates to database schema.
#deprecation_notice For any upcoming deprecation functionality.
#internal For changesets that need to be excluded from the final changelog.
#nops For any feature that is NOP facing and needs to be in the official Release Notes for the release.
#removed For any functionality/config that is removed.
#updated For any functionality that is updated.
#wip For any change that is not ready yet and external communication about it should be held off till it is feature complete.

patrickhuie19 · 2026-02-04T00:27:53Z

core/services/gateway/handlers/vault/handler.go

 		return errors.New("request ID cannot be empty")
 	}
+	if len(req.ID) > 200 {
+		// Arbitrary limit to prevent abuse


are requestIDs well formed? i'm surprised we can't lock in a known limit of the size of the request ID here

Here's the spec: https://www.jsonrpc.org/specification
It just needs a unique id that could be a string.
So there's no fixed locked size.

I just think 200 is a safe enough buffer for anyone using any funky way for associating this id to their internal ids.

@prashantkumar1982 sure, but my understanding is the gateway isn't a domain agnostic rpc proxy. We use it for particular domains, and those domains should have our request patterns well mapped. What is that for the Vault DON? @MStreet3 do you know the max expected request.ID size for HTTP Triggers?

For Vault, we don't have any restriction.
All we enforce, is that ids should be unique strings.

core/services/gateway/handlers/vault/handler_test.go

trunk-io · 2026-02-04T01:03:22Z

_{View Full Report ↗︎ ⋅ Docs}

… into vault_reqid_check

Copilot

Pull request overview

Adds request ID length limits to mitigate abuse and refactors Vault public key handling to rely on cached responses for cheaper unauthenticated access.

Changes:

Enforce a max length (200 chars) on JSON-RPC request IDs in the gateway and Vault handler.
Refactor Vault PublicKeyGet to return a cached response directly (and adjust periodic cache refresh to use internal handler methods).
Add/adjust tests for the new request ID limit and the public key caching path.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
core/services/gateway/handlers/vault/handler.go	Adds request ID length validation; changes `PublicKeyGet` to serve cached responses directly; updates periodic cache refresh helper to return errors.
core/services/gateway/handlers/vault/handler_test.go	Updates public key test flow to seed cache via internal methods before asserting cached behavior.
core/services/gateway/gateway.go	Adds request ID length validation at the gateway layer.
core/services/gateway/gateway_test.go	Adds coverage for gateway rejection of overly long request IDs.

Comments suppressed due to low confidence (2)

core/services/gateway/handlers/vault/handler_test.go:764

This test seeds the public key cache by calling private methods directly, but it no longer covers the cold-cache behavior for a user request (HandleJSONRPCUserMessage with MethodPublicKeyGet). Given the handler change, it would be valuable to add an assertion that the first user request still succeeds (or returns a well-defined error) when the cache is empty.

		"d6da96fe596705b32bc3a0e11cdefad77feaad79000000000000000000000000",
		"327aa349c9718cd36c877d1e90458fe1929768ad000000000000000000000000",
		"e9bf394856d73402b30e160d0e05c847796f0e29000000000000000000000000",
		"efd5bdb6c3256f04489a6ca32654d547297f48b9000000000000000000000000",

core/services/gateway/handlers/vault/handler_test.go:795

Grammar in this comment is a bit unclear ("make HandleJSONRPCUserMessage request"). Consider rephrasing to something like "make another request via HandleJSONRPCUserMessage" for readability.

		ID:     "request_id",

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

core/services/gateway/handlers/vault/handler.go

core/services/gateway/gateway.go

core/services/gateway/handlers/vault/handler.go

cedric-cordenier · 2026-02-04T16:49:33Z

core/services/gateway/handlers/vault/handler.go

 				case <-tickerVaultPublicKeyRefresh.Chan():
 					// periodically, fetch vault public key, so we can cache it
-					h.fetchVaultPublicKey(ctx)
+					_ = h.fetchVaultPublicKey(ctx)


Nit: maybe handle the error here and log it? I see we do a lot of logging of errors inside fetchVaultPublicKey so we can move that out maybe?

I had changed signature of this to call it from tests. But later didn't use it. Reverting it back to old logging.

… into vault_reqid_check

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

core/services/gateway/handlers/vault/handler.go

Copilot · 2026-02-04T22:58:15Z

core/services/gateway/gateway.go

+	if len(jsonRequest.ID) > 200 {
+		// Arbitrary limit to prevent abuse
+		return newError(jsonRequest.ID, api.UserMessageParseError, "request ID is too long: "+strconv.Itoa(len(jsonRequest.ID))+". max is 200 characters")
+	}


The magic number 200 for maximum request ID length is duplicated across multiple files (gateway.go and vault/handler.go). Consider defining a constant like MaxRequestIDLength to ensure consistency and make future changes easier to maintain. This constant could be defined in a shared package like core/services/gateway/api/constants.go.

Copilot · 2026-02-04T22:58:15Z

core/services/gateway/handlers/vault/handler.go

+	if len(req.ID) > 200 {
+		// Arbitrary limit to prevent abuse
+		return errors.New("request ID is too long: " + strconv.Itoa(len(req.ID)) + ". max is 200 characters")
+	}


The request ID length validation logic is duplicated between gateway.go and vault/handler.go. This creates a maintenance burden and risk of inconsistency if the limit needs to be changed. Consider extracting this validation into a shared function or performing it only at the gateway layer to follow the DRY principle.

Suggested change

if len(req.ID) > 200 {

// Arbitrary limit to prevent abuse

return errors.New("request ID is too long: " + strconv.Itoa(len(req.ID)) + ". max is 200 characters")

}

core/services/gateway/handlers/vault/handler.go

cl-sonarqube-production · 2026-02-04T23:20:20Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

patrickhuie19

approved. please circle back to my comment on request.id size @prashantkumar1982

prashantkumar1982 added 2 commits February 3, 2026 14:51

Checks on json reques id size

b8092de

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

3981928

… into vault_reqid_check

prashantkumar1982 added 2 commits February 3, 2026 15:48

lint

644edbd

lint2

fc72105

patrickhuie19 reviewed Feb 4, 2026

View reviewed changes

core/services/gateway/handlers/vault/handler_test.go Show resolved Hide resolved

prashantkumar1982 marked this pull request as ready for review February 4, 2026 02:43

prashantkumar1982 requested review from a team as code owners February 4, 2026 02:43

Copilot AI review requested due to automatic review settings February 4, 2026 02:43

product-security-plaid-production bot requested a review from bolekk February 4, 2026 02:43

Copilot started reviewing on behalf of prashantkumar1982 February 4, 2026 02:43 View session

prashantkumar1982 added 2 commits February 3, 2026 18:52

unit-test

e9108c6

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

e187c32

… into vault_reqid_check

Copilot AI reviewed Feb 4, 2026

View reviewed changes

core/services/gateway/handlers/vault/handler.go Outdated Show resolved Hide resolved

core/services/gateway/gateway.go Show resolved Hide resolved

core/services/gateway/handlers/vault/handler.go Outdated Show resolved Hide resolved

cedric-cordenier reviewed Feb 4, 2026

View reviewed changes

cedric-cordenier previously approved these changes Feb 4, 2026

View reviewed changes

prashantkumar1982 added 2 commits February 4, 2026 14:34

respond to comments

be98cb3

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

fb1f540

… into vault_reqid_check

prashantkumar1982 dismissed cedric-cordenier’s stale review via fb1f540 February 4, 2026 22:34

prashantkumar1982 changed the title ~~Checks on json request id size~~ CRE Gateway: Checks on json request id size to prevent abuse Feb 4, 2026

prashantkumar1982 requested a review from Copilot February 4, 2026 22:47

Copilot started reviewing on behalf of prashantkumar1982 February 4, 2026 22:48 View session

Copilot AI reviewed Feb 4, 2026

View reviewed changes

lint

865ce6e

prashantkumar1982 enabled auto-merge February 4, 2026 23:49

patrickhuie19 approved these changes Feb 5, 2026

View reviewed changes

cedric-cordenier approved these changes Feb 5, 2026

View reviewed changes

prashantkumar1982 added this pull request to the merge queue Feb 5, 2026

Merged via the queue into develop with commit 84001b2 Feb 5, 2026
223 checks passed

prashantkumar1982 deleted the vault_reqid_check branch February 5, 2026 10:19

Conversation

prashantkumar1982 commented Feb 3, 2026

Uh oh!

github-actions bot commented Feb 3, 2026

Uh oh!

patrickhuie19 Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

prashantkumar1982 Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

patrickhuie19 Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

prashantkumar1982 Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

trunk-io bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cedric-cordenier Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

prashantkumar1982 Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cl-sonarqube-production bot commented Feb 4, 2026

Quality Gate passed

Uh oh!

patrickhuie19 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

trunk-io bot commented Feb 4, 2026 •

edited

Loading