Update from ProLeague.gg

Security and reliability day. Three things, all found by looking rather than by an incident - except the first one, which was an incident.

Our rate limiter was keyed on IP. The frontend proxies all REST traffic through its own server, so every user's requests arrived at the API from a handful of rotating proxy egress IPs. Keyed on IP, the entire user base shared those buckets, and one tournament page's roughly ten-call fan-out started 429'ing everybody. The limiter now keys on the signed user when a request carries a valid token - one bucket per user, wherever the request came from - and keeps the per-IP bucket for everything else. Signature verification only, deliberately: this is a bucket key, not an auth decision, and anything unparseable falls back to the IP bucket, because a limiter must never reject the request it is counting.

Second, an open redirect on our own verify page. The next parameter came off the query string unchecked and went straight into a client-side redirect, so a link on our domain could sign somebody in and then send them elsewhere - carrying our URL, sign-in parameters included, in the Referer on the way out. The middleware that SETS that parameter already validated it correctly; the page that READ it did not. String tests do not work here - //evil.com is protocol-relative, /\evil.com gets normalized by the browser, /%09/evil.com survives a startsWith check - so we resolve the value against the request origin and compare, which collapses all of them.

Third, two internal dashboards were reachable on public ports. They are password-gated now.

Also shipped: sessions end when the API answers 401 instead of leaving a dead client logged in, and a cache read no longer hangs the request when Redis is unreachable.

Devnet: app.proleague.gg