fix(server): prevent duplicate request id attack on peer adapter (#1474)

dinwwwh · web-flow · commit 5ebcc863823b · 2026-03-13T08:22:44.000+07:00
Fixes #1473  ## Summary by CodeRabbit * **Bug Fixes** * Improved handling of duplicate requests—when an identical request is already in flight, the duplicate is now ignored and returns the original response instead of being processed again.
diff --git a/packages/standard-server-peer/src/server.test.ts b/packages/standard-server-peer/src/server.test.ts
@@ -317,6 +317,35 @@ describe('serverPeer', () => {
       expect(handle).toHaveBeenCalledTimes(1)
     })
 
+    it('duplicate request message should be ignored', async () => {
+      handle.mockImplementationOnce(async () => baseResponse)
+
+      const promise = peer.message(
+        await encodeRequestMessage(REQUEST_ID, MessageType.REQUEST, baseRequest),
+        handle,
+      )
+
+      // Send duplicate while first request is still processing
+      const [id, request] = await peer.message(
+        await encodeRequestMessage(REQUEST_ID, MessageType.REQUEST, baseRequest),
+        handle,
+      )
+
+      expect(id).toBe(REQUEST_ID)
+      expect(request).toBeUndefined()
+      // handle should only be called once (duplicate ignored)
+      expect(handle).toHaveBeenCalledTimes(1)
+
+      const [id2, request2] = await promise
+      expect(id2).toBe(REQUEST_ID)
+      expect(request2).toEqual({
+        ...baseRequest,
+        signal: expect.any(AbortSignal),
+      })
+
+      expect(send).toHaveBeenCalledTimes(1)
+    })
+
     it('handle throw error', async () => {
       handle.mockImplementationOnce(async () => {
         throw new Error('some error')
diff --git a/packages/standard-server-peer/src/server.ts b/packages/standard-server-peer/src/server.ts
@@ -125,6 +125,10 @@ export class experimental_ServerPeerWithoutCodec {
       return [id, undefined]
     }
 
+    if (this.clientControllers.has(id)) { // duplicate request message, should be ignored
+      return [id, undefined]
+    }
+
     const clientController = this.open(id)
     const signal = clientController.signal
 

Original file line number	Diff line number	Diff line change
`@@ -125,6 +125,10 @@ export class experimental_ServerPeerWithoutCodec {`
`125`	`125`	`return [id, undefined]`
`126`	`126`	`}`
`127`	`127`
	`128`	`+ if (this.clientControllers.has(id)) { // duplicate request message, should be ignored`
	`129`	`+ return [id, undefined]`
	`130`	`+ }`
	`131`	`+`
`128`	`132`	`const clientController = this.open(id)`
`129`	`133`	`const signal = clientController.signal`
`130`	`134`