aiolabs/events
9
0
Fork 0
Code Issues 32 Pull requests Projects Releases 2 Packages Wiki Activity Actions

Rate-limit anonymous ticket creation; reap unpaid guest rows on cancel #38

New issue
Open
opened 2026-09-06 17:55:08 +00:00 by padreug · 0 comments
padreug commented 2026-09-06 17:55:08 +00:00
Owner
Copy link

POST /events/api/v1/tickets/{event_id} is anonymous by design (guest checkout, #36) and has no rate limit: any caller can mint invoices and Stripe Checkout Sessions against an event (up to quantity=10 per call), creating unpaid rows and Stripe sessions in the organizer's account. Unpaid rows are only purged after 24 h (crud.purge_unpaid_tickets), so a burst can also exhaust visible capacity for a day if the client counts unpaid rows.

Proposal

  • Per-IP + per-event token bucket on ticket creation (e.g. 5/min, 30/h), 429 with Retry-After.
  • Cap outstanding unpaid rows per event from one IP/email.
  • Stripe ?checkout=cancelled return: the webapp could call a new DELETE /api/v1/tickets/pending/{payment_hash} (anonymous, only deletes unpaid rows for that hash) so an abandoned checkout frees the seats immediately instead of at the 24 h sweep.
  • Consider a captcha / proof-of-work only if abuse is observed.

Related: #29 (identity limits on free claims).

`POST /events/api/v1/tickets/{event_id}` is anonymous by design (guest checkout, #36) and has no rate limit: any caller can mint invoices and Stripe Checkout Sessions against an event (up to `quantity=10` per call), creating unpaid rows and Stripe sessions in the organizer's account. Unpaid rows are only purged after 24 h (`crud.purge_unpaid_tickets`), so a burst can also exhaust visible capacity for a day if the client counts unpaid rows. ## Proposal - Per-IP + per-event token bucket on ticket creation (e.g. 5/min, 30/h), 429 with `Retry-After`. - Cap outstanding **unpaid** rows per event from one IP/email. - Stripe `?checkout=cancelled` return: the webapp could call a new `DELETE /api/v1/tickets/pending/{payment_hash}` (anonymous, only deletes unpaid rows for that hash) so an abandoned checkout frees the seats immediately instead of at the 24 h sweep. - Consider a captcha / proof-of-work only if abuse is observed. Related: #29 (identity limits on free claims).
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/organizer-sender-identity
feat/ticket-email-sent-copy
ticket-scanner-nostr
backup/main-pre-v1.3-rebase-2026-05-05
feat/event-approval-workflow
fix/sqlite-ticket-extra-serialization
v1.6.8-aio.4
v1.6.8-aio.3
v1.6.8-aio.2
v1.6.8-aio.1
v1.6.1-aio.18
v1.6.1-aio.17
v1.6.1-aio.16
v1.6.1-aio.15
v1.6.1-aio.14
v1.6.1-aio.13
v1.6.1-aio.10
v1.6.1-aio.9
v1.6.1-aio.8
v1.6.1-aio.6
v1.6.1-aio.5
v1.6.1-aio.3
v1.6.1-aio.2
v1.6.1-aio.1
v1.3.0-aio.6
v1.3.0-aio.5
v1.3.0-aio.4
v1.3.0-aio.3
v1.3.0-aio.2
v1.3.0-aio.1
v1.2.1-aio.2
v1.2.1-aio.1
v1.2.1
v0.0.2
v0.0.1
v1.2.0
v1.1.0
v1.0.0
v0.2.0
v0.1.6
v0.1.5
v0.1.4
v0.1.3
0.1.2
0.1.1
0.1
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aiolabs/events#38
No description provided.