security: prevent unauthenticated metric-label cardinality DoS

[juzhiyuan]

Summary

Proxy metrics currently use the raw request path as the endpoint label before authentication. Unauthenticated callers can create unbounded time series through unique passthrough paths.

Source

• Imported from Codex Security scan results shared in Slock #Dev:bc985f48 (chatgpt.com.har).
• This issue groups findings with the same engineering boundary to avoid fragmented fixes.
• Triage priority: P1.

Covered scanner findings

• feat(admin): CRUD for Models + ApiKeys with pluggable ConfigStore #11 Unbounded metrics labels allow unauthenticated proxy DoS — request.uri().path() is used as a metrics label before auth and includes attacker-controlled passthrough suffixes.

Expected fix direction

• Normalize metric endpoint labels to a fixed route template such as /passthrough/:provider/*rest before recording.
• Avoid recording high-cardinality labels derived from unauthenticated raw paths.
• Verify zero-value gauge series are removed or bounded if the metrics backend retains label sets.
• Add a regression test that many unique unauthenticated passthrough paths produce bounded metric series.

Definition of done

• Fix is covered by regression tests for the affected mode/provider/endpoint.
• The fix is applied at the shared boundary where possible, not only at one provider call site.
• Security behavior is documented in code comments or docs where operator expectations change.

[coderabbitai]

🔗 Related PRs

#355 - fix(proxy): use UUID request IDs across handlers [merged]
#363 - fix(proxy): record messages stream telemetry [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!