/ 
PAGI-FastAPI-v1.3.0

Changes for version 1.3.0 - 2026-08-23

  • SECURITY FIXES
    • Fix rate-limit key resolution using untrusted HTTP request headers (CWE-807). Default key_cb now strictly identifies clients by their TCP socket address ($c->scope->{client}[0]) rather than prioritising client-controlled headers. Header-derived identity can be explicitly enabled by setting 'trust_proxies => 1'. Reported by CPANSec.
    • Fix unbounded memory growth in PAGI::FastAPI::RateLimit::Driver::Memory (CWE-770). Enforce a maximum active key limit (`max_keys`, defaults to 10000) with key eviction, and add periodic probabilistic cache sweeps to purge stale entries. Reported by CPANSec.
  • ENHANCEMENTS
    • Add trust_proxies parameter to PAGI::FastAPI::Middleware::RateLimit.
    • Add max_keys parameter and count() introspection method to PAGI::FastAPI::RateLimit::Driver::Memory.
  • TESTING
    • Add t/32-security_cwe_807_key_spoofing.t to test header-spoofing resilience.
    • Add t/33-security_cwe_770_memory_cap.t to test driver memory bounds.

Documentation

README.md
TODO.md

Modules

PAGI::FastAPI
Asynchronous, Type-Safe Micro-Framework with Dependency Injection and OpenAPI & Swagger UI
PAGI::FastAPI::BotProtection
Base Interface for PAGI::FastAPI Bot Protection
PAGI::FastAPI::BotProtection::ProofOfWork
Stateless Proof-of-Work Bot Mitigation Engine
PAGI::FastAPI::Context
Request and Response Lifecycle Context for PAGI::FastAPI
PAGI::FastAPI::Cookies
Request Cookie Parsing Helper for PAGI::FastAPI
PAGI::FastAPI::Depends
Dependency Injection Wrapper for PAGI::FastAPI
PAGI::FastAPI::Middleware::BotProtection
Asynchronous Proof-of-Work Bot Protection Middleware for PAGI::FastAPI
PAGI::FastAPI::Middleware::ExceptionHandler
Typed Exception-to-Handler Dispatch for PAGI::FastAPI
PAGI::FastAPI::Middleware::RateLimit
Async Rate Limiting Middleware for PAGI::FastAPI
PAGI::FastAPI::Queue
Pluggable Async Message Queue Facade for PAGI::FastAPI
PAGI::FastAPI::Queue::Driver
Abstract Base Class for Message Queue Storage Drivers
PAGI::FastAPI::Queue::Driver::Memory
Default In-Memory Storage Driver for PAGI::FastAPI::Queue
PAGI::FastAPI::RateLimit::Driver
Abstract Base Class for Rate Limiting Storage Drivers
PAGI::FastAPI::RateLimit::Driver::Memory
Default In-Memory Storage Driver for Rate Limiting
PAGI::FastAPI::Response
Base HTTP Response Class for PAGI::FastAPI
PAGI::FastAPI::Response::File
File Download Response for PAGI::FastAPI
PAGI::FastAPI::Response::HTML
HTML Response Class for PAGI::FastAPI
PAGI::FastAPI::Response::Redirect
HTTP Redirect Response for PAGI::FastAPI
PAGI::FastAPI::Response::SSE
Server-Sent Events (SSE) Streaming Response for PAGI::FastAPI
PAGI::FastAPI::ResponseModel
Response Shape Validation and Filtering for PAGI::FastAPI
PAGI::FastAPI::TypedPath
Path Parameter Validation for PAGI::FastAPI

Examples

Other files