Severity: MEDIUM
Location: src/Middleware/RateLimitMiddleware.php:61
Bug: GET + POST of overlapping paths share the counter.
Fix: Include method in the key.
Status: open. Will reply with remediation details when resolved.
[M-23] Rate-limit key not scoped by HTTP method
Resolved.
RateLimitMiddleware now includes the HTTP method in the hash key (src/Middleware/RateLimitMiddleware.php):
$key = hash('sha256', $ip . '|' . $method . '|' . $path, true);
GET and POST to the same path no longer share a counter. A benign user's GET traffic against a route that collides with a write-path POST can't suppress their ability to make POSTs.
Locking this thread.
