Rate Limit for search endpoints #2185
Labels
No labels
accessibility
bug
bug
infrastructure
Codeberg
contributions welcome
docs
duplicate
enhancement
infrastructure
legal
licence / ToS
please chill
we are volunteers
public relations
question
question
user support
s/Forgejo
s/Forgejo/migration
s/Pages
s/Weblate
s/Woodpecker
security
service
upstream
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
Codeberg/Community#2185
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Comment
In light of the recent outage I had a look at the rate-limiting configuration and - as far as I can see - there are no stricter rate-limits for search endpoints present.
If I read the configuration correctly it's currently possible to perform 4000 searches within 30 minutes per IP (that's 2.22 searches per second).
That sounds quite risky considering that searches are usually quite expensive to perform.
For example GitHub has implement very hard rate limits on searches when you are not authenticated (Code searches are not allowed at all and other searches are usually capped to ~10 per minute).
Search is currently not that expensive and it's hidden for larger repositories and only shown if you're logged in:
{{if and $.IsSigned (le .Repository.Size 700000000)}}We've not yet seen abuse of these endpoints but will keep this in mind if starts becoming a problem.