RocketChat / RocketChat/Rocket.Chat

API Rate Limit bypass `api-bypass-rate-limit` not respected

Open
#24,539 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

We have a system that creates groups, assigns users to those groups, uploads images to chat etc. by using a Chat Bot.
After 10 rapid calls to the HTTP APIs it's been blocked by the global Rate Limiter which by default has Default number calls to the rate limiter (API_Enable_Rate_Limiter_Limit_Calls_Default) set to 10.

By checking the bot has api-bypass-rate-limit permission, nevertheless the limit is enforced for that user as well.

Steps to reproduce:
  1. Ensure the user that is permorming the HTTP calls has api-bypass-rate-limit and that the global API Rate Limit is enabled with default number of calls set to 10.
  2. Perform 11 rapid calls (~1 per second)
Expected behavior:

The 11th call succeds

Actual behavior:

The 11th call is being blocked. See screenshot:

thumb-Screenshot from 2022-02-17 18-41-18

Server Setup Information:
  • Version of Rocket.Chat Server: 3.18.3
  • Operating System: Linux
  • Deployment Method: snap
  • Number of Running Instances: 1
  • DB Replicaset Oplog:
  • NodeJS Version: v12.22.1
  • MongoDB Version: 3.6.14 / wiredTiger (oplog Enabled)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the 11 rapid HTTP calls with an account holding api-bypass-rate-limit, then trace the global API rate limiter and its permission check. Done means the 11th call succeeds for that account while the configured limit still applies to users without the permission.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.