Rate Limit for search endpoints #2185

Open
opened 2025-10-25 21:19:43 +02:00 by litetex · 1 comment

Comment

In light of the recent outage I had a look at the rate-limiting configuration and - as far as I can see - there are no stricter rate-limits for search endpoints present.

If I read the configuration correctly it's currently possible to perform 4000 searches within 30 minutes per IP (that's 2.22 searches per second).

That sounds quite risky considering that searches are usually quite expensive to perform.

For example GitHub has implement very hard rate limits on searches when you are not authenticated (Code searches are not allowed at all and other searches are usually capped to ~10 per minute).

### Comment In light of the recent outage I had a look at the [rate-limiting configuration](https://codeberg.org/Codeberg-Infrastructure/scripted-configuration/src/commit/e4aaceeb434a82d2b8c610284006d3d0a3cbe665/hosts/_reverseproxy/etc/caddy/forgejo-prod.site) and - as far as I can see - there are no stricter rate-limits for search endpoints present. If I read the configuration correctly it's currently possible to perform 4000 searches within 30 minutes per IP (that's 2.22 searches per second). That sounds quite risky considering that searches are usually quite expensive to perform. For example GitHub has implement very hard rate limits on searches when you are not authenticated (Code searches are not allowed at all and other searches are usually capped to ~10 per minute).
Owner

Search is currently not that expensive and it's hidden for larger repositories and only shown if you're logged in:

{{if and $.IsSigned (le .Repository.Size 700000000)}}

We've not yet seen abuse of these endpoints but will keep this in mind if starts becoming a problem.

Search is currently not _that_ expensive and it's hidden for larger repositories and only shown if you're logged in: https://codeberg.org/Codeberg-Infrastructure/forgejo/src/commit/1faa2bdecd683cd416e2acf944a2d8f03a906f16/templates/repo/home.tmpl#L178 We've not yet seen abuse of these endpoints but will keep this in mind if starts becoming a problem.
Sign in to join this conversation.
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Codeberg/Community#2185
No description provided.