RocketChat / RocketChat/Rocket.Chat
API Rate Limit bypass `api-bypass-rate-limit` not respected
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Description:
We have a system that creates groups, assigns users to those groups, uploads images to chat etc. by using a Chat Bot.
After 10 rapid calls to the HTTP APIs it's been blocked by the global Rate Limiter which by default has Default number calls to the rate limiter (API_Enable_Rate_Limiter_Limit_Calls_Default) set to 10.
By checking the bot has api-bypass-rate-limit permission, nevertheless the limit is enforced for that user as well.
Steps to reproduce:
- Ensure the user that is permorming the HTTP calls has
api-bypass-rate-limitand that the global API Rate Limit is enabled with default number of calls set to 10. - Perform 11 rapid calls (~1 per second)
Expected behavior:
The 11th call succeds
Actual behavior:
The 11th call is being blocked. See screenshot:

Server Setup Information:
- Version of Rocket.Chat Server: 3.18.3
- Operating System: Linux
- Deployment Method: snap
- Number of Running Instances: 1
- DB Replicaset Oplog:
- NodeJS Version: v12.22.1
- MongoDB Version: 3.6.14 / wiredTiger (oplog Enabled)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the 11 rapid HTTP calls with an account holding api-bypass-rate-limit, then trace the global API rate limiter and its permission check. Done means the 11th call succeeds for that account while the configured limit still applies to users without the permission.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100