security(ofrep): prevent shared client-key rate-limit starvation

[pierrick-fonquerne]

Severity

Medium — authenticated denial of service against every consumer sharing a client-kind SDK key.

Problem

Client keys are intended for browser and mobile distribution and are therefore not a strong per-user secret. OFREP rate limiting is keyed only by the SDK key prefix. Any holder of a shared client key can consume the entire bucket and cause 429 responses for all other users of that environment.

Acceptance criteria

• Client-key traffic has a fairness model that does not allow one source to monopolize the entire environment quota.
• The design combines an environment/key budget with a bounded source dimension such as trusted client IP or another documented signal.
• Server-kind keys retain an appropriate machine-to-machine policy independent of public client-key traffic.
• Source-key bucket cardinality and memory use are strictly bounded.
• Proxy trust rules prevent clients from forging the source identity through forwarded headers.
• Metrics expose saturation at global, SDK-key and source levels without logging raw keys or user identifiers.
• Tests demonstrate that one abusive client receives throttling while unrelated clients using the same key continue within their budget.
• Deployment documentation clarifies that client keys are identifiers/scopes, not confidential authentication credentials.