Skip to content

Fix rate-limit load test CSRF 403s#111

Merged
s-b-e-n-s-o-n merged 1 commit intomainfrom
fix/load-test-csrf
Mar 6, 2026
Merged

Fix rate-limit load test CSRF 403s#111
s-b-e-n-s-o-n merged 1 commit intomainfrom
fix/load-test-csrf

Conversation

@s-b-e-n-s-o-n
Copy link
Contributor

@s-b-e-n-s-o-n s-b-e-n-s-o-n commented Mar 6, 2026

Summary

  • Rate-limit burst test fires 31 sequential POSTs in one virtual user flow
  • After first POST, session cookie is set → subsequent POSTs trigger CSRF validation → 403 Forbidden
  • All 31 requests got 403 instead of reaching the rate limiter (expected ≥1 HTTP 429)
  • Fix: disable Artillery's cookie jar (http.cookieJar: false) so every request authenticates independently via Basic auth — no cookie = no CSRF check

Test plan

  • CI Load Test (CI) job passes with rate-limit correctness check producing ≥1 HTTP 429

🤖 Generated with Claude Code

@s-b-e-n-s-o-n
🐛 fix(load-test): disable cookie jar in rate-limit burst test
ea0e306 
The rate-limit test fires 31 sequential POSTs in a single virtual user
flow. After the first POST authenticates via Basic auth, the server sets
a session cookie. Subsequent POSTs carry the cookie, triggering CSRF
validation which requires an Origin header. Without it, all remaining
requests get 403 instead of reaching the rate limiter.

Disable Artillery's cookie jar for this test so every request
authenticates independently via Basic auth — no cookie means no CSRF
check, which is the correct model for an API-only rate-limit test.
@codecov
Copy link

codecov bot commented Mar 6, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@s-b-e-n-s-o-n s-b-e-n-s-o-n merged commit be88315 into main Mar 6, 2026
14 checks passed
@s-b-e-n-s-o-n s-b-e-n-s-o-n deleted the fix/load-test-csrf branch March 6, 2026 18:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@biggest-littlest biggest-littlest biggest-littlest approved these changes

@ALARGECOMPANY ALARGECOMPANY ALARGECOMPANY approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@s-b-e-n-s-o-n @biggest-littlest @ALARGECOMPANY