David Essien

Fair, a single global guard shouldn't carry one blanket failure policy, defaulting open, with fail-closed reserved for the specific routes where sensitive operations are carried out. Login endpoint will also fail open. Good callout on webhook retries too, I hadn't separated that from general traffic. A flat limit treating a legitimate retry storm the same as abuse, exactly when you'd want the opposite, is a real gap. Worth handling on its own rather than folding it into the same limit. Fixing both. Thank you for your input.

Yeah you're right, the check is a literal match on the json tag, so a bare fence slips past it and breaks the parse. However, the blog post is a simplified reconstructed version of my actual production code, so it does not fall straight through. Fixing the bare fence bug with your suggested regex. Thank you very much.

Hadn't thought about it in terms of a step-token specifically, but it makes sense as the piece that closes the stolen-cookie case, which my fix doesn't touch. Good addition, appreciate you separating the two clearly.