ProjectTech4DevAI / ProjectTech4DevAI/kaapi-backend

Security: Introduce rate limit per endpoint

Open
#452 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Python
Stars
18
Forks
10
Avg merge
2d 20h
Merged PRs (30d)
14

Description

Describe the current behavior
Currently, Kaapi API endpoints have no rate limiting implemented. Any user or organization can make unlimited requests to any endpoint without restrictions. This creates several issues:

  • A single user or organization can overwhelm the API with requests, consuming server resources and degrading performance for other users
  • There's no protection against accidental or malicious misuse, such as runaway scripts or bot activity
  • Celery operations like document uploads with provider integration or collection creation can cause celery job queue bloating

Describe the enhancement you'd like
Implement api level rate limiting across relevant API routes to ensure fair resource allocation and prevent misuse. The rate limiting should be conditional based on if it is a celery job endpoint or not. celery job endpoints such as collection creation, llm calls, etc should have lower number of api calls allowed per minute as compared to non celery job endpoints such as credential, onboarding, etc which can have higher number of api calls allowed per minute.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the API route definitions and the Celery-backed endpoints, then inventory which operations should receive each rate limit. Clarify the per-minute thresholds and the rate-limiting mechanism before implementation. Done means requests are limited differently for Celery and non-Celery endpoints, preventing queue or resource overload.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend-api-design, performance, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.