RocketChat / RocketChat/Rocket.Chat

Disabling DDP Rate Limiter does not affect createDirectMessage

Open
#19,641 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

The createDirectMessage method needs to be called for a room to be created between two users.
https://docs.rocket.chat/api/realtime-api/method-calls/create-direct-message

In order to receive realtime messages from any user in the application, I need to call createDirectMessage for each user.

However, this is rate limited to 10x / minute:
https://github.com/RocketChat/Rocket.Chat/blob/develop/server/methods/createDirectMessage.js

The Administration section has the option to disable rate limiting for DDP methods, but this disabling does not affect createDirectMessage.

Steps to reproduce:
  1. Go to Administration > Rate Limiter
  2. Disable all DDP Rate Limiter options
  3. Call createDirectMessage 11 times in a minute
Expected behavior:

I am able to call the createDirectMessage method 11 times in a minute.

No errors are received.

Actual behavior:

When I call createDirectMessage method more than 10x per minute, I received an error:

{"msg":"result","id":"ddp-15","error":{"isClientSafe":true,"error":"too-many-requests","reason":"Error, too many requests. Please slow down. You must wait 54 seconds before trying again.","details":{"timeToReset":53975},"message":"Error, too many requests. Please slow down. You must wait 54 seconds before trying again. [too-many-requests]","errorType":"Meteor.Error"}}

Server Setup Information:
  • Version of Rocket.Chat Server: 2.4.11
  • Operating System: Linux
  • Number of Running Instances: 1
  • NodeJS Version: v8.17.0
  • MongoDB Version:3.6.14
Client Setup Information
  • Desktop App or Browser Version: Google Chrome (latest)
  • Operating System: MacOS

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with server/methods/createDirectMessage.js and trace how its rate limiter is configured relative to the Administration > Rate Limiter DDP settings. Reproduce the issue by disabling all DDP rate-limit options and calling createDirectMessage 11 times within a minute; done means the eleventh call succeeds without a too-many-requests error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.