Api Rate Abuse in Laravel with Openid Connect

Rate abuse in Laravel when OpenID Connect (OIDC) is used for authentication can occur when rate limiting is applied after the identity has been authenticated, or not applied at all to token-introspection and userinfo endpoints. OIDC adds flows such as authorization code and implicit grants, with redirects back to your application and tokens passed in headers or cookies. If rate limits are only enforced on public endpoints and not on the OIDC callback or token validation paths, an attacker can flood the token verification path to trigger excessive validation calls, exhaust server-side cache for introspection results, or amplify brute-force attempts on user identifiers.

In Laravel, the common pattern is to use an OIDC package (e.g., bjeavons/zookeeper-oidc, laravel/passport with OIDC extensions, or custom middleware) that validates ID tokens via JWKS, optionally introspecting opaque tokens. Without explicit rate limiting on these validation routines, an attacker can send many crafted authorization requests with varying nonces or tokens, causing repeated expensive operations such as JWKS fetching, signature verification, and session lookups. This can lead to denial of service or allow token or user enumeration when error responses differ per condition. Because OIDC relies on well-known discovery documents and JWKS sets, an attacker may also probe multiple issuers or redirect URIs to test misconfigurations.

For example, consider an endpoint that handles the OIDC callback and validates an ID token. If this endpoint is unthrottled, an attacker can automate repeated callback requests with malformed tokens, observing timing differences or error messages to infer validity. Similarly, the userinfo endpoint, which requires a valid access token, might lack per-client or per-user rate limits, enabling enumeration of user profiles by iterating subject identifiers or access tokens. In hybrid flows where tokens are passed in fragments or stored in cookies, missing rate controls on token introspection or session creation endpoints can allow rapid creation of server-side sessions, consuming resources and potentially bypassing intended limits applied only to API routes.

Compounding the issue, Laravel’s rate limiting is often scoped to IP or authenticated user IDs. With OIDC, clients may appear under different identifiers depending on token contents, and session-based limits may not apply until after token validation. If the discovery document or JWKS endpoint is public and unrestricted, an attacker can cause excessive outbound fetches, impacting performance. Therefore, effective mitigation requires rate limiting at the network ingress for discovery and introspection paths, as well as at the application level for callback and userinfo endpoints, aligned with the client identifier rather than only IP.

middleBrick can detect missing or misconfigured rate limiting on OIDC-related endpoints by scanning the API surface and correlating runtime behavior with the OpenAPI specification. Using the scan’s Rate Limiting checks alongside OIDC-specific findings, you can identify gaps where token validation and userinfo endpoints lack throttling. The tool’s per-category breakdowns help prioritize fixes and map them to frameworks such as OWASP API Top 10.

To secure OIDC flows in Laravel, apply rate limits to sensitive OIDC endpoints and ensure throttling is keyed by client or token subject where feasible. Below are concrete examples that integrate with common OIDC packages and Laravel’s built-in rate limiting.

1. Rate limiting OIDC callback and token validation

Define a dedicated rate limit for the callback route that handles the OIDC response. Use a key that includes the client ID to prevent cross-client abuse.

// routes/web.php or routeServiceProvider.php
use Illuminate\Support\Facades\Route;
use Illuminate\Http\Request;

Route::get('/oidc/callback', [OidcController::class, 'callback'])
    ->name('oidc.callback')
    ->middleware('throttle:oidc_callback,5');

// app/Http/Kernel.php — define a custom rate limiter
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;

protected function configureRateLimiting()
{
    RateLimiter::for('oidc_callback', function (Request $request) {
        $clientId = $request->input('client_id') ?? $request->route('client_id');
        // key by client if available, otherwise fall back to IP
        $key = $clientId ? 'oidc.callback.client:'.$clientId : 'oidc.callback.ip:'.$request->ip();
        return Limit::perMinute(30)->by($key);
    });
}

2. Rate limiting userinfo and introspection endpoints

If your application exposes userinfo or introspection endpoints, apply separate rate limits keyed by access token or subject identifier to avoid enumeration and DoS.

// app/Http/Middleware/RateLimitOidcScopes.php
namespace App\Http\Middleware;

use Closure;
use Illuminate\Cache\RateLimiter;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class RateLimitOidcScopes
{
    public function handle(Request $request, Closure $next): Response
    {
        $limiter = app(RateLimiter::class);
        $token = $request->bearerToken() ?? $request->get('access_token');
        $subject = $this->extractSubjectFromToken($token); // implement JWKS/introspection lookup cautiously
        $key = 'oidc.userinfo.'.($subject ?: $request->ip());

        if ($limiter->tooManyAttempts($key, 60)) {
            return response()->json(['error' => 'rate_limited'], Response::HTTP_TOO_MANY_REQUESTS);
        }

        $limiter->hit($key, 60);
        return $next($request);
    }

    private function extractSubjectFromToken(?string $token): ?string
    {
        if (!$token) {
            return null;
        }
        // For opaque tokens, call introspection endpoint cautiously with its own rate limit
        // For JWTs, decode without verification only for subject extraction if necessary
        return null;
    }
}

// routes/web.php
Route::middleware(['auth', 'oidc', RateLimitOidcScopes::class])
    ->group(function () {
        Route::get('/userinfo', [UserinfoController::class, 'show']);
    });

// app/Providers/RouteServiceProvider.php — ensure discovery and introspection have their own limits
protected function configureRateLimiting()
{
    RateLimiter::for('introspection', function (Request $request) {
        // key by token hash to limit repeated introspection of the same token
        $token = $request->bearerToken() ?? '';
        return Limit::perMinute(10)->by('introspect:'.hash_hmac('sha256', $token, config('app.key')));
    });
}

3. Secure OIDC discovery and JWKS fetching

Ensure discovery and JWKS endpoints are not abused by applying global or route-specific limits and caching JWKS responses to reduce remote calls.

// config/oidc.php
return [
    'issuer' => env('OIDC_ISSUER'),
    'discovery_cache_ttl' => 3600, // cache discovery doc
    'jwks_cache_ttl' => 3600,
];

// app/Providers/OidcServiceProvider.php
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Str;

public function jwks()
{
    $cacheKey = 'oidc.jwks.'.md5($this->config['issuer']);
    return Cache::remember($cacheKey, now()->addSeconds($this->config['jwks_cache_ttl']), function () {
        $response = Http::get($this->config['issuer'].'/.well-known/openid-configuration')
            ->throw()
            ->json('jwks_uri');
        return Http::get($response)->throw()->json('keys');
    });
}

// Apply rate limit to the route exposing .well-known/openid-configuration if public
Route::get('/.well-known/openid-configuration', function () {
    return response()->json(config('oidc.discovery'));
})->middleware('throttle:discovery,4');

Route::get('/.well-known/jwks', function () {
    return response()->json(app(OidcProvider::class)->jwks());
})->middleware('throttle:jwks,4');

4. Validate state and nonce to prevent injection and replay

Always validate state and nonce parameters in callbacks to prevent CSRF and token injection attacks. Store nonce server-side and enforce uniqueness with rate limits to deter replay floods.

// In callback handler
$storedNonce = session('oidc.nonce');
$receivedNonce = $request->input('nonce');
if (!$receivedNonce || $receivedNonce !== $storedNonce) {
    return redirect('/login')->withErrors(['Invalid state/nonce']);
}
// Optionally, rate limit nonce validation failures per client to deter brute-force
RateLimiter::hit('oidc.nonce.'.$clientId, now()->addMinutes(5));

By combining Laravel’s rate limiting primitives with OIDC-aware scoping and caching, you reduce the risk of token validation abuse, user enumeration, and DoS against introspection and userinfo endpoints. These controls complement the broader security posture and align with OWASP API Top 10 and common compliance mappings tracked by scanners such as middleBrick.