{"record":{"id":"3127f7f47e169692","repo":"hashicorp/nomad","slug":"too-many-auth-requests","errorCode":null,"errorMessage":"too many auth requests","messagePattern":"too many auth requests","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/auth/oidc/request.go","lineNumber":21,"sourceCode":"\npackage oidc\n\nimport (\n\t\"errors\"\n\t\"fmt\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/hashicorp/cap/oidc\"\n\t\"github.com/hashicorp/golang-lru/v2/expirable\"\n)\n\nvar (\n\tErrNonceReuse = errors.New(\"nonce reuse detected\")\n\t// ErrTooManyRequests is returned if the request cache is full.\n\t// Realistically, we expect this only to happen if the auth-url\n\t// API endpoint is being DOS'd.\n\tErrTooManyRequests = errors.New(\"too many auth requests\")\n)\n\n// MaxRequests is how many requests are allowed to be stored at a time.\n// It needs to be large enough for legitimate user traffic, but small enough\n// to prevent a DOS from eating up server memory.\nconst MaxRequests = 1000\n\n// NewRequestCache creates a cache for OIDC requests.\n// The JWT expiration time in the cap library is 5 minutes,\n// so timeout should be around that long.\nfunc NewRequestCache(timeout time.Duration) *RequestCache {\n\treturn &RequestCache{\n\t\tc: expirable.NewLRU[string, *oidc.Req](MaxRequests, nil, timeout),\n\t}\n}\n\ntype RequestCache struct {\n\tc    *expirable.LRU[string, *oidc.Req]","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/lib/auth/oidc/request.go#L3-L39","documentation":"ErrTooManyRequests is returned when the RequestCache already holds MaxRequests (1000) entries and a new OIDC auth-url request cannot be stored. The bounded LRU cache exists so pending OIDC auth requests cannot exhaust server memory.","triggerScenarios":"RequestCache.storeLocked is invoked while rc.c.Len() >= MaxRequests (1000) — i.e. more than 1000 in-flight auth-url requests with nonces not yet consumed by callbacks.","commonSituations":"DOS or burst traffic against the ACL auth-url endpoint (as the source comment notes); callbacks never arriving so stale entries occupy the cache until TTL expiry; load tests generating thousands of parallel logins.","solutions":["Retry the auth-url request after a short delay; entries expire from the expirable LRU cache, freeing capacity.","Mitigate the traffic source — rate-limit or block abusive clients hammering the auth-url endpoint.","Investigate why callbacks are not consuming entries (stuck sessions), and verify cache TTL/MaxRequests sizing suits your legitimate traffic."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := rc.store(req)\nif errors.Is(err, oidc.ErrTooManyRequests) {\n    time.Sleep(backoff) // then retry the auth-url request\n    return retryAuthURL()\n}","preventionTips":["Rate-limit the auth-url endpoint upstream","Tune MaxRequests and cache TTL to legitimate traffic levels","Monitor cache occupancy and alert on sustained high usage","Ensure clients always complete callbacks so entries get consumed"],"tags":["oidc","rate-limit","dos","cache-full"],"backgroundTag":"too-many-auth-requests","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}