From c6ef56fd5e8f2648a256ae1479ddc28d0164c602 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Thu, 2 Feb 2023 00:07:49 +0100 Subject: [PATCH] Change rate limits to 1,500/5m per user, 300/5m per app (#23347) --- config/initializers/rack_attack.rb | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 72ef7ba80..3857e3055 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -33,6 +33,10 @@ class Rack::Attack authenticated_token&.resource_owner_id end + def authenticated_token_id + authenticated_token&.id + end + def unauthenticated? !authenticated_user_id end @@ -62,10 +66,14 @@ class Rack::Attack IpBlock.blocked?(req.remote_ip) end - throttle('throttle_authenticated_api', limit: 300, period: 5.minutes) do |req| + throttle('throttle_authenticated_api', limit: 1_500, period: 5.minutes) do |req| req.authenticated_user_id if req.api_request? end + throttle('throttle_per_token_api', limit: 300, period: 5.minutes) do |req| + req.authenticated_token_id if req.api_request? + end + throttle('throttle_unauthenticated_api', limit: 300, period: 5.minutes) do |req| req.throttleable_remote_ip if req.api_request? && req.unauthenticated? end