#36200 rpc: invalid credentials can occupy every HTTP worker

ReviewabilityReviewsAgreementSize
#36200 hodlinator rpc: invalid credentials can occupy every HTTP workerReady0Strong0 + 36 tests
  • Prevent unauthorized clients from tying up all HTTP RPC worker threads with invalid credentials
  • Stop denial of service against legitimate authenticated RPC callers
  • Ready to review
  • Author moved the PR to draft to consider an alternative dedicated slow-reply thread design
  • No review verdicts recorded
  • Support because the worker exhaustion vector is cheap and easy to hit (willcl-ark)
  • Resolved objection: removing the sleep speeds up password guessing, but DoS risk is worse (willcl-ark)
  • 0 lines added or modified outside tests
  • 36 lines added or modified in tests
  • 6 lines removed in total
  • 2 files, 1 commits
RPC / REST / ZMQ#4 of 55
P2 · DoS protection
  • P2 because it fixes an easy resource exhaustion denial-of-service vector on the HTTP server
  • Prevents unauthenticated clients with network access from blocking legitimate RPC calls
Ranking notes
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Removes the 250 ms UninterruptibleSleep executed upon HTTP RPC authentication failure and adds a functional test ensuring valid RPCs are not delayed by failed authentications. The sleep was originally added to mitigate timing attacks and slow brute-forcing, but timing resistance is now handled by TimingResistantEqual.

Problem: Any client with network access to the node's RPC port can easily tie up all HTTP worker threads by submitting requests with invalid Basic auth credentials, causing denial of service for legitimate authenticated callers.

Reviewability

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

  • decision: author is mulling design alternatives regarding password guess rate vs worker DoS 2026-10-12

Agreement

Strong

substantive support, no open objection (willcl-ark)

Thread notes: No new participants or claims from reviewers. The author posted comments exploring alternatives to simply removing the sleep in draft state.

Objections, suggestions, and questions:

ReviewerTypeHarm, request, or questionStatusMust beAuthor repliedQuote
willcl-ark (member)objection, safetyremoving the sleep increases the rate at which an unauthorized client can guess RPC passwordsaccepted · reviewer accepted that the DoS vector is cheaper and easier to hit and favored patching it as proposedansweredyes2026-09-09: 'This sleep also slows online password guessing, so I'm not sure I agree that it was made redundant'
Status from: 2026-09-10: willcl-ark: 'I think the DoS vector identified here is cheaper/easier to hit (and more annoying), so I'd be in favour of patching tha'
willcl-ark (member)suggestion, maintenancedocument using external tools like fail2ban to mitigate repeated password guessinganswered · author replied questioning whether adding fail2ban docs would make RPC ports appear intended to be exposed to the public internetansweredyes2026-09-10: 'Perhaps we can leave repeated guessing up to external tools like fail2ban or similar (and document, if wanted)?'
Status from: 2026-09-10: hodlinator: 'Hm.. wondering if we should add fail2ban docs or not. Maybe it just makes the RPC/HTTP ports seem more like something wh'

Support:

  • willcl-ark (member) (2026-09-10) [read]: I think the DoS vector identified here is cheaper/easier to hit (and more annoying), so I'd be in favour of patching that up as you propose.

Participants:

  • willcl-ark (member, objection, 2 statements 2026-09-09 to 2026-09-10): noted the sleep slows password guessing, but ultimately favored removing it to fix the cheaper DoS vector

Files

36 lines under test/bench/ci.

  • test/functional/interface_http.py +36/-0
  • src/httprpc.cpp +0/-6

Card

The short text the ranking pass compares across PRs.

This PR removes a 250 ms worker-thread sleep triggered on RPC authentication failure in src/httprpc.cpp to prevent clients with RPC network access from exhausting HTTP workers and causing a denial of service. While removing the sleep increases the potential password guessing rate, timing attacks are already addressed by TimingResistantEqual. willcl-ark favored patching the DoS vector over keeping the sleep, while discussion remains open on alternatives like external fail2ban documentation. The patch is small and ready for review on the security trade-off.

Data

dossier JSON · extract JSON · model ledger, generated 2026-10-13T01:21, confidence high, input hash e683785cdc9255d4
thread read through 2026-10-12 (6 statements), head 15ced063da
labels: RPC/REST/ZMQ · draft

Categories

RPC / REST / ZMQ

P2 · DoS protection

Fixes a denial-of-service vector where clients can tie up all HTTP RPC worker threads by submitting invalid credentials. Category guidance explicitly emphasizes 'resource exhaustion through the HTTP server', and removing the 250 ms UninterruptibleSleep closes an easy worker-exhaustion vulnerability without reintroducing timing attack risks.

Membership: Matches the RPC/REST/ZMQ label and modifies HTTP RPC authentication handling in src/httprpc.cpp.

Factors: security/stability 2, bug 2, performance 1, user value 0, leverage 0