mirrors/gotosocial
1
0
Fork 1
mirror of https://github.com/superseriousbusiness/gotosocial.git synced 2024-11-01 06:28:57 +00:00
Code Issues Projects Releases Packages Wiki Activity
gotosocial/docs/api/ratelimiting.md

42 lines
2.7 KiB
Markdown
Raw Normal View History

[feature] HTTP request throttling middleware (#1297) * [feature] Add throttling middleware to AP endpoints * refactor a lil bit * use config setting, start updating docs * doc updates * use relative links in faq doc * small docs fixes * return code 503 instead of 429 when throttled * throttle other endpoints too * simplify token channel prefills
2023-01-04 10:57:59 +00:00
# Request Rate Limiting
[feature] Make rate limit requests amount configurable (#966) * update rate limit documentation * regenerate landingpage config helpers * make rate limit rate configurable
2022-11-06 09:47:48 +00:00
[chore] The Big Middleware and API Refactor (tm) (#1250) * interim commit: start refactoring middlewares into package under router * another interim commit, this is becoming a big job * another fucking massive interim commit * refactor bookmarks to new style * ambassador, wiz zeze commits you are spoiling uz * she compiles, we're getting there * we're just normal men; we're just innocent men * apiutil * whoopsie * i'm glad noone reads commit msgs haha :blob_sweat: * use that weirdo go-bytesize library for maxMultipartMemory * fix media module paths
2023-01-02 12:10:50 +00:00
To mitigate abuse + scraping of your instance, IP-based HTTP rate limiting is in place.
[feature] Make rate limit requests amount configurable (#966) * update rate limit documentation * regenerate landingpage config helpers * make rate limit rate configurable
2022-11-06 09:47:48 +00:00
[chore] The Big Middleware and API Refactor (tm) (#1250) * interim commit: start refactoring middlewares into package under router * another interim commit, this is becoming a big job * another fucking massive interim commit * refactor bookmarks to new style * ambassador, wiz zeze commits you are spoiling uz * she compiles, we're getting there * we're just normal men; we're just innocent men * apiutil * whoopsie * i'm glad noone reads commit msgs haha :blob_sweat: * use that weirdo go-bytesize library for maxMultipartMemory * fix media module paths
2023-01-02 12:10:50 +00:00
There are separate rate limiters configured for different groupings of endpoints. In other words, being rate limited for one part of the API doesn't necessarily mean you will be rate limited for other parts. Each entry in the following list has a separate rate limiter:
[feature] Make rate limit requests amount configurable (#966) * update rate limit documentation * regenerate landingpage config helpers * make rate limit rate configurable
2022-11-06 09:47:48 +00:00
[chore] The Big Middleware and API Refactor (tm) (#1250) * interim commit: start refactoring middlewares into package under router * another interim commit, this is becoming a big job * another fucking massive interim commit * refactor bookmarks to new style * ambassador, wiz zeze commits you are spoiling uz * she compiles, we're getting there * we're just normal men; we're just innocent men * apiutil * whoopsie * i'm glad noone reads commit msgs haha :blob_sweat: * use that weirdo go-bytesize library for maxMultipartMemory * fix media module paths
2023-01-02 12:10:50 +00:00
- `/users/*` and `/emoji/*` - ActivityPub (s2s) endpoints.
- `/auth/*` and `/oauth/*` - Sign in + OAUTH token requests.
- `/fileserver/*` - Media attachments, emojis, etc.
- `/nodeinfo/*` - NodeInfo endpoint(s).
- `/.well-known/*` - webfinger + nodeinfo requests.
By default, each rate limiter allows a maximum of 300 requests in a 5 minute time window: 1 request per second per client IP address.
[feature] Make rate limit requests amount configurable (#966) * update rate limit documentation * regenerate landingpage config helpers * make rate limit rate configurable
2022-11-06 09:47:48 +00:00
Every response will include the current status of the rate limit with the following headers:
- `X-Ratelimit-Limit`: maximum number of requests allowed per time period.
- `X-Ratelimit-Remaining`: number of remaining requests that can still be performed within.
[feature] Add rate limit exceptions option, use ISO8601 for rate limit reset (#2151) * start updating rate limiting, add exceptions * tests, comments, tidying up * add rate limiting exceptions to example config * envparsing * nolint * apply kimbediff * add examples
2023-08-23 12:32:27 +00:00
- `X-Ratelimit-Reset`: ISO8601 timestamp indicating when the rate limit will reset.
[feature] Make rate limit requests amount configurable (#966) * update rate limit documentation * regenerate landingpage config helpers * make rate limit rate configurable
2022-11-06 09:47:48 +00:00
In case the rate limit is exceeded, an [HTTP 429 Too Many Requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429) error is returned to the caller.
## Rate Limiting FAQs
### My rate limit keeps being exceeded! Why?
[docs] Both HTTP proxies and NAT can cause rate limiting issues (#1053) Also explain specifically that setting the rate limit to zero turns off rate limiting rather than actually setting the limit to zero, since this is not intuitive.
2022-11-15 16:31:14 +00:00
If you find that your rate limit is regularly being exceeded (both for yourself and other callers) during normal use of your instance, it may be that GoToSocial can't tell the clients apart by IP address. You can investigate this by viewing the logs of your instance. If (almost) all logged IP addresses appear to be the same IP address (something like `172.x.x.x`), then the rate limiting will cause problems.
[feature] Make rate limit requests amount configurable (#966) * update rate limit documentation * regenerate landingpage config helpers * make rate limit rate configurable
2022-11-06 09:47:48 +00:00
[docs] Both HTTP proxies and NAT can cause rate limiting issues (#1053) Also explain specifically that setting the rate limit to zero turns off rate limiting rather than actually setting the limit to zero, since this is not intuitive.
2022-11-15 16:31:14 +00:00
This happens when your server is running inside NAT (port forwarding), or behind an HTTP proxy without the correct configuration, causing your instance to see all incoming IP addresses as the same address: namely, the IP address of your reverse proxy or gateway. This means that all incoming requests are *sharing the same rate limit*, rather than being split correctly per IP.
If you are using an HTTP proxy then it's likely that your `trusted-proxies` is not correctly configured. If this is the case, try adding the IP address of your reverse proxy to the list of `trusted-proxies`, and restarting your instance.
If you don't have an HTTP proxy, then it's likely caused by NAT. In this case you should disable rate limiting altogether.
[feature] Make rate limit requests amount configurable (#966) * update rate limit documentation * regenerate landingpage config helpers * make rate limit rate configurable
2022-11-06 09:47:48 +00:00
### Can I configure the rate limit? Can I just turn it off?
[docs] Both HTTP proxies and NAT can cause rate limiting issues (#1053) Also explain specifically that setting the rate limit to zero turns off rate limiting rather than actually setting the limit to zero, since this is not intuitive.
2022-11-15 16:31:14 +00:00
Yes! Set `advanced-rate-limit-requests: 0` in the config.
[feature] Add rate limit exceptions option, use ISO8601 for rate limit reset (#2151) * start updating rate limiting, add exceptions * tests, comments, tidying up * add rate limiting exceptions to example config * envparsing * nolint * apply kimbediff * add examples
2023-08-23 12:32:27 +00:00
### Can I exclude one or more IP addresses from rate limiting, but leave the rest in place?
Yes! Set `advanced-rate-limit-exceptions` in the config.
Reference in a new issue Copy permalink