ProjectTech4DevAI / ProjectTech4DevAI/kaapi-backend
Security: Introduce rate limit per endpoint
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 18
- Forks
- 10
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 14
Description
Describe the current behavior
Currently, Kaapi API endpoints have no rate limiting implemented. Any user or organization can make unlimited requests to any endpoint without restrictions. This creates several issues:
- A single user or organization can overwhelm the API with requests, consuming server resources and degrading performance for other users
- There's no protection against accidental or malicious misuse, such as runaway scripts or bot activity
- Celery operations like document uploads with provider integration or collection creation can cause celery job queue bloating
Describe the enhancement you'd like
Implement api level rate limiting across relevant API routes to ensure fair resource allocation and prevent misuse. The rate limiting should be conditional based on if it is a celery job endpoint or not. celery job endpoints such as collection creation, llm calls, etc should have lower number of api calls allowed per minute as compared to non celery job endpoints such as credential, onboarding, etc which can have higher number of api calls allowed per minute.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the API route definitions and the Celery-backed endpoints, then inventory which operations should receive each rate limit. Clarify the per-minute thresholds and the rate-limiting mechanism before implementation. Done means requests are limited differently for Celery and non-Celery endpoints, preventing queue or resource overload.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend-api-design, performance, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100