Redmine

  before_action :session_expiration, :user_setup, :check_api_rate_limit, :check_if_login_required, :set_localization, :check_password_change, :check_twofa_activation

  # Rejects the request with 429 Too Many Requests when the API caller

  # exceeded Setting.rest_api_rate_limit requests per minute.

  # Requests are counted per user when authenticated, per source IP

  # otherwise, so that repeated requests with invalid credentials are

  # throttled as well. Web UI requests are never throttled.

  def check_api_rate_limit

    return unless api_request?

    limit = Setting.rest_api_rate_limit.to_i

    bucket = User.current.logged? ? "user/#{User.current.id}" : "ip/#{request.remote_ip}"

    if Redmine::ApiRateLimiter.throttled?(bucket, limit)

      logger.warn("API rate limit exceeded for #{bucket} (#{request.request_method} #{request.path})") if logger

      response.headers['Retry-After'] = Redmine::ApiRateLimiter.retry_after.to_s

      response.headers['X-RateLimit-Limit'] = limit.to_s

      @error_messages = [l(:error_api_rate_limit_exceeded)]

      render :template => 'common/error_messages', :format => [:api], :status => :too_many_requests, :layout => nil

    end

  end

<p><%= setting_text_field :rest_api_rate_limit, :size => 6 %></p>

  error_api_rate_limit_exceeded: "Rate limit exceeded. Please retry later."

  setting_rest_api_rate_limit: Maximum number of API requests per minute and user or IP (0 means no limit)

rest_api_rate_limit:

  format: int

  default: 0

  security_notifications: 1

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

module Redmine

  # Fixed-window rate limiter for REST API requests.

  #

  # Requests are counted per caller (an opaque "bucket" string) in fixed

  # windows of WINDOW seconds. Counters live in a cache store (Rails.cache

  # by default), so no database schema change is required.

  #

  # The store is injectable, mainly for the tests: the test environment is

  # configured with the :null_store cache (config/environments/test.rb),

  # which does not keep counters.

  module ApiRateLimiter

    # Window length in seconds

    WINDOW = 60

    class << self

      attr_writer :store

      # The cache store holding the request counters

      def store

        @store ||= Rails.cache

      end

      # Increments the request counter of +bucket+ and returns true when

      # more than +limit+ requests were made within the current window,

      # false otherwise. A +limit+ of zero disables throttling.

      #

      # Fails open: with a store that does not support atomic counters

      # (e.g. the :null_store) no request is ever throttled.

      def throttled?(bucket, limit)

        return false unless limit > 0

        count = store.increment(counter_key(bucket), 1, :expires_in => WINDOW * 2)

        !count.nil? && count > limit

      end

      # Number of seconds until the current window ends, suitable for the

      # Retry-After response header

      def retry_after

        WINDOW - (Time.now.to_i % WINDOW)

      end

      private

      def counter_key(bucket)

        "api_rate_limiter/#{bucket}/#{Time.now.to_i / WINDOW}"

      end

    end

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../../test_helper'

class Redmine::ApiTest::RateLimitingTest < Redmine::ApiTest::Base

  def setup

    super

    # The test environment runs with the :null_store cache, which does not

    # keep counters, so give the limiter a real in-memory store

    Redmine::ApiRateLimiter.store = ActiveSupport::Cache::MemoryStore.new

  end

  def teardown

    super

    Redmine::ApiRateLimiter.store = nil

    User.current = nil

  end

  def test_api_requests_within_the_limit_should_succeed

    with_settings :rest_api_rate_limit => '3' do

      3.times do

        get '/users/current.json', :headers => credentials('jsmith')

        assert_response :ok

      end

    end

  end

  def test_api_requests_over_the_limit_should_get_429_with_retry_after_header

    with_settings :rest_api_rate_limit => '2' do

      2.times do

        get '/users/current.json', :headers => credentials('jsmith')

        assert_response :ok

      end

      get '/users/current.json', :headers => credentials('jsmith')

      assert_response :too_many_requests

      assert_includes 1..60, response.headers['Retry-After'].to_i

      assert_equal '2', response.headers['X-RateLimit-Limit']

      assert_equal ['Rate limit exceeded. Please retry later.'], response.parsed_body['errors']

    end

  end

  def test_over_the_limit_response_should_be_available_in_xml

    with_settings :rest_api_rate_limit => '1' do

      get '/users/current.xml', :headers => credentials('jsmith')

      assert_response :ok

      get '/users/current.xml', :headers => credentials('jsmith')

      assert_response :too_many_requests

      assert_equal 'application/xml', response.media_type

      assert_select 'errors error', :text => 'Rate limit exceeded. Please retry later.'

    end

  end

  def test_rate_limit_should_be_counted_per_user

    with_settings :rest_api_rate_limit => '1' do

      get '/users/current.json', :headers => credentials('jsmith')

      assert_response :ok

      get '/users/current.json', :headers => credentials('jsmith')

      assert_response :too_many_requests

      get '/users/current.json', :headers => credentials('admin')

      assert_response :ok

    end

  end

  def test_anonymous_api_requests_should_be_limited_by_ip

    with_settings :rest_api_rate_limit => '1' do

      get '/issues.json'

      assert_response :ok

      get '/issues.json'

      assert_response :too_many_requests

    end

  end

  def test_rate_limit_should_not_apply_when_disabled

    with_settings :rest_api_rate_limit => '0' do

      5.times do

        get '/users/current.json', :headers => credentials('jsmith')

        assert_response :ok

      end

    end

  end

  def test_rate_limit_should_not_apply_to_web_ui_requests

    with_settings :rest_api_rate_limit => '1' do

      3.times do

        get '/login'

        assert_response :ok

      end

    end

  end

end

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../../../test_helper'

class Redmine::ApiRateLimiterTest < ActiveSupport::TestCase

  def setup

    Redmine::ApiRateLimiter.store = ActiveSupport::Cache::MemoryStore.new

  end

  def teardown

    Redmine::ApiRateLimiter.store = nil

  end

  def test_throttled_should_be_false_within_the_limit

    3.times do

      assert_not Redmine::ApiRateLimiter.throttled?('user/1', 3)

    end

  end

  def test_throttled_should_be_true_above_the_limit

    3.times {Redmine::ApiRateLimiter.throttled?('user/1', 3)}

    assert Redmine::ApiRateLimiter.throttled?('user/1', 3)

  end

  def test_buckets_should_be_counted_independently

    3.times {Redmine::ApiRateLimiter.throttled?('user/1', 3)}

    assert Redmine::ApiRateLimiter.throttled?('user/1', 3)

    assert_not Redmine::ApiRateLimiter.throttled?('user/2', 3)

    assert_not Redmine::ApiRateLimiter.throttled?('ip/127.0.0.1', 3)

  end

  def test_zero_limit_should_disable_throttling

    5.times do

      assert_not Redmine::ApiRateLimiter.throttled?('user/1', 0)

    end

  end

  def test_counters_should_reset_when_the_window_ends

    4.times {Redmine::ApiRateLimiter.throttled?('user/1', 3)}

    assert Redmine::ApiRateLimiter.throttled?('user/1', 3)

    travel Redmine::ApiRateLimiter::WINDOW.seconds do

      assert_not Redmine::ApiRateLimiter.throttled?('user/1', 3)

    end

  end

  def test_throttled_should_fail_open_when_the_store_does_not_count

    Redmine::ApiRateLimiter.store = ActiveSupport::Cache::NullStore.new

    5.times do

      assert_not Redmine::ApiRateLimiter.throttled?('user/1', 1)

    end

  end

  def test_retry_after_should_be_within_the_current_window

    assert_includes 1..Redmine::ApiRateLimiter::WINDOW, Redmine::ApiRateLimiter.retry_after

  end

end