fix(create-a-container): loosen in-app rate limit by removing entirely

create-a-container/app.js

@@ -15,24 +15,20 @@ const morgan = require('morgan');
 const fs = require('fs');
 const SequelizeStore = require('express-session-sequelize')(session.Store);
 const path = require('path');
-const RateLimit = require('express-rate-limit');
 const swaggerUi = require('swagger-ui-express');
 const YAML = require('yamljs');
 const { sequelize } = require('./models');
 
 /**
  * @param {object} options
  * @param {string|string[]} options.sessionSecrets - express-session secret(s); required.
- * @param {boolean} [options.rateLimit=true]  - disable in tests: assertions on 4xx
- *                                              responses must not burn the budget.
  * @param {boolean} [options.accessLog=true]  - morgan; disable in tests for quiet output.
  * @param {string}  [options.mcpServerUrl]    - origin of the MCP server to reverse-proxy
  *                                              at /mcp (default: $MCP_SERVER_URL). Unset
  *                                              disables the proxy.
  */
 function buildApp({
   sessionSecrets,
-  rateLimit = true,
   accessLog = true,
   mcpServerUrl = process.env.MCP_SERVER_URL,
 } = {}) {
@@ -98,20 +94,6 @@ function buildApp({
 
   app.use(express.static('public'));
 
-  // We rate limit unsuccessful (4xx/5xx statuses, excluding 404) to only 10 per 5 minutes, this
-  // should allow legitimate users a few tries to login or experiment without
-  // allowing bad-actors to abuse requests. 404s are excluded because browsers
-  // (especially Safari) automatically request favicon/apple-touch-icon paths that
-  // don't exist, and those harmless misses should not burn the rate-limit budget.
-  if (rateLimit) {
-    app.use(RateLimit({
-      windowMs: 5 * 60 * 1000,
-      max: 10,
-      skipSuccessfulRequests: true,
-      requestWasSuccessful: (req, res) => res.statusCode < 400 || res.statusCode === 404,
-    }));
-  }
-
   // CSRF guard for every handler that can see the session cookie (CodeQL
   // js/missing-token-validation). Behavior-preserving: csrfGuard skips
   // GET/HEAD/OPTIONS and Bearer-only requests, and every state-changing

create-a-container/middlewares/__tests__/mcp-proxy.test.js

@@ -47,7 +47,6 @@ function startUpstream() {
 function build(mcpServerUrl) {
   return buildApp({
     sessionSecrets: ['test-secret'],
-    rateLimit: false,
     accessLog: false,
     mcpServerUrl,
   });

create-a-container/package.json

@@ -26,7 +26,6 @@
     "csrf-sync": "^4.2.1",
     "dotenv": "^17.2.3",
     "express": "^5.2.1",
-    "express-rate-limit": "^8.5.1",
     "express-session": "^1.19.0",
     "express-session-sequelize": "^2.3.0",
     "morgan": "^1.11.0",

create-a-container/tests/helpers/app.js

@@ -4,8 +4,6 @@
  * options:
  *
  *   - fixed session secret (production reads secrets from the DB in server.js)
- *   - rate limiting off (tests assert on 4xx responses; the limiter would
- *     start rejecting them after 10)
  *   - access log off (quiet output)
  *
  * Tests normally authenticate with a Bearer API key (apiAuth accepts it and
@@ -23,7 +21,6 @@ const { buildApp: buildRealApp } = require('../../app');
 function buildApp() {
   return buildRealApp({
     sessionSecrets: ['test-secret'],
-    rateLimit: false,
     accessLog: false,
   });
 }