nextcloud / nextcloud/spreed

🐌 Introducing rate limits for API endpoints

Open
#9,631 2 comments 0 reactions 1 assignee View on GitHub

@nickvergessen is already working on this.

Since May 26, 2023.

enhancement feature: api 🛠️ technical debt
Dominant language
PHP
Stars
2.2k
Forks
587
Avg merge
18h 27m
Merged PRs (30d)
333

Description

As per https://docs.nextcloud.com//server/stable/developer_manual/basics/controllers.html#rate-limiting Talk should start to use rate limits. For each endpoint we should consider the following 3 options:

  • UserRateLimit / AnonRateLimit - Mostly POST API endpoint which should be limited to avoid bugging others, e.g. posting chat messages, starting calls, etc.
  • Abuse rate limit (1k-5k/h) - GET poll results because no one should have legit interest to get e.g. 1k poll results within 1 hour. While it might still hit from time to time in worst cases, similarly how I'm throttled by github when I do the branch-off 3 times a year.
  • No rate limit - Really not limitation because high frequence is necessary to perform "properly", e.g. fetch chat or signaling messages

AvatarController

  • AvatarController::uploadAvatar()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • AvatarController::emojiAvatar()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • AvatarController::getAvatar()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • AvatarController::getAvatarDark()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • AvatarController::deleteAvatar()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

BreakoutRoomController

  • BreakoutRoomController::configureBreakoutRooms()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • BreakoutRoomController::removeBreakoutRooms()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • BreakoutRoomController::broadcastChatMessage()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • BreakoutRoomController::applyAttendeeMap()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • BreakoutRoomController::requestAssistance()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • BreakoutRoomController::resetRequestForAssistance()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • BreakoutRoomController::startBreakoutRooms()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • BreakoutRoomController::stopBreakoutRooms()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • BreakoutRoomController::switchBreakoutRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

CallController

  • CallController::getPeersForCall()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • CallController::joinCall()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • CallController::ringAttendee()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • CallController::updateCallFlags()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • CallController::leaveCall()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

ChatController

  • ChatController::receiveMessages()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::sendMessage()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::clearHistory()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::deleteMessage()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::getMessageContext()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::setReadMarker()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::markUnread()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::mentions()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::shareObjectToChat()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::getObjectsSharedInRoomOverview()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ChatController::getObjectsSharedInRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

CommandController

  • CommandController::index()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

FederationController

  • FederationController::acceptShare()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • FederationController::rejectShare()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • FederationController::getShares()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

FilesIntegrationController

  • FilesIntegrationController::getRoomByFileId()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • FilesIntegrationController::getRoomByShareToken()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

GuestController

  • GuestController::setDisplayName()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

HostedSignalingServerController

  • HostedSignalingServerController::requestTrial()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • HostedSignalingServerController::auth()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • HostedSignalingServerController::deleteAccount()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

MatterbridgeSettingsController

  • MatterbridgeController::getBridgeOfRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • MatterbridgeController::getBridgeProcessState()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • MatterbridgeController::editBridgeOfRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • MatterbridgeController::deleteBridgeOfRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • MatterbridgeSettingsController::stopAllBridges()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • MatterbridgeSettingsController::getMatterbridgeVersion()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

PageController

  • PageController::index()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • PageController::notFound()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • PageController::duplicateSession()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • PageController::showCall()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • PageController::authenticatePassword()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • PageController::recording()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

PollController

  • PollController::createPoll()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • PollController::showPoll()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • PollController::votePoll()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • PollController::closePoll()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

PublicShareAuthController

  • PublicShareAuthController::createRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

ReactionController

  • ReactionController::react()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ReactionController::delete()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • ReactionController::getReactions()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

RecordingController

  • RecordingController::getWelcomeMessage()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RecordingController::backend()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RecordingController::start()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RecordingController::stop()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RecordingController::store()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RecordingController::notificationDismiss()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RecordingController::shareToChat()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

RoomController

  • RoomController::getRooms()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::getListedRooms()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::createRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::getSingleRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::getBreakoutRooms()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::renameRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::deleteRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::makePublic()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::makePrivate()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setDescription()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setReadOnly()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setListable()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setPassword()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setPermissions()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::getParticipants()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::getBreakoutRoomParticipants()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::addParticipantToRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::removeSelfFromRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::removeAttendeeFromRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setAttendeePermissions()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setAllAttendeesPermissions()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::joinRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::resendInvitations()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::leaveRoom()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::promoteModerator()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::demoteModerator()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::addToFavorites()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::removeFromFavorites()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::getParticipantByDialInPin()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::createGuestByDialIn()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setNotificationLevel()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setNotificationCalls()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setLobby()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setSIPEnabled()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • RoomController::setMessageExpiration()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

SettingsController

  • SettingsController::setSIPSettings()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • SettingsController::setUserSetting()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

SignalingController

  • SignalingController::getSettings()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • SignalingController::getWelcomeMessage()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • SignalingController::backend()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • SignalingController::signaling()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • SignalingController::pullMessages()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

TempAvatarController

  • TempAvatarController::postAvatar()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit
  • TempAvatarController::deleteAvatar()
    • UserRateLimit / AnonRateLimit
    • Abuse rate limit (1k-5k/h)
    • No rate limit

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.