fix(core): Add rate limiting to mcp-oauth endpoints (n8n-io#24734)

Author: RicardoE105

packages/cli/src/modules/mcp/mcp.oauth.controller.ts

@@ -2,6 +2,7 @@ import { authorizationHandler } from '@modelcontextprotocol/sdk/server/auth/hand
 import { clientRegistrationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/register.js';
 import { revocationHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/revoke.js';
 import { tokenHandler } from '@modelcontextprotocol/sdk/server/auth/handlers/token.js';
+import { Time } from '@n8n/constants';
 import { Get, Options, RootLevelController, StaticRouterMetadata } from '@n8n/decorators';
 import { Container } from '@n8n/di';
 import type { Response, Request, Router } from 'express';
@@ -29,31 +30,43 @@ export class McpOAuthController {
 			path: '/mcp-oauth/register',
 			router: clientRegistrationHandler({ clientsStore: mcpOAuthService.clientsStore }) as Router,
 			skipAuth: true,
+			ipRateLimit: { limit: 10, windowMs: 5 * Time.minutes.toMilliseconds },
 		},
 		{
 			path: '/mcp-oauth/authorize',
 			router: authorizationHandler({ provider: mcpOAuthService }) as Router,
 			skipAuth: true,
+			ipRateLimit: { limit: 50, windowMs: 5 * Time.minutes.toMilliseconds },
 		},
 		{
 			path: '/mcp-oauth/token',
 			router: tokenHandler({ provider: mcpOAuthService }) as Router,
 			skipAuth: true,
+			ipRateLimit: { limit: 20, windowMs: 5 * Time.minutes.toMilliseconds },
 		},
 		{
 			path: '/mcp-oauth/revoke',
 			router: revocationHandler({ provider: mcpOAuthService }) as Router,
 			skipAuth: true,
+			ipRateLimit: { limit: 30, windowMs: 5 * Time.minutes.toMilliseconds },
 		},
 	];
 
-	@Options('/.well-known/oauth-authorization-server', { skipAuth: true, usesTemplates: true })
+	@Options('/.well-known/oauth-authorization-server', {
+		skipAuth: true,
+		usesTemplates: true,
+		ipRateLimit: { limit: 100, windowMs: 5 * Time.minutes.toMilliseconds },
+	})
 	metadataOptions(_req: Request, res: Response) {
 		this.setCorsHeaders(res);
 		res.status(204).end();
 	}
 
-	@Get('/.well-known/oauth-authorization-server', { skipAuth: true, usesTemplates: true })
+	@Get('/.well-known/oauth-authorization-server', {
+		skipAuth: true,
+		usesTemplates: true,
+		ipRateLimit: { limit: 100, windowMs: 5 * Time.minutes.toMilliseconds },
+	})
 	metadata(_req: Request, res: Response) {
 		this.setCorsHeaders(res);
 
@@ -77,6 +90,7 @@ export class McpOAuthController {
 	@Options('/.well-known/oauth-protected-resource/mcp-server/http', {
 		skipAuth: true,
 		usesTemplates: true,
+		ipRateLimit: { limit: 100, windowMs: 5 * Time.minutes.toMilliseconds },
 	})
 	protectedResourceMetadataOptions(_req: Request, res: Response) {
 		this.setCorsHeaders(res);
@@ -86,6 +100,7 @@ export class McpOAuthController {
 	@Get('/.well-known/oauth-protected-resource/mcp-server/http', {
 		skipAuth: true,
 		usesTemplates: true,
+		ipRateLimit: { limit: 100, windowMs: 5 * Time.minutes.toMilliseconds },
 	})
 	protectedResourceMetadata(_req: Request, res: Response) {
 		this.setCorsHeaders(res);