Redmine

  # Length of the window used to rate limit the API, in seconds

  API_RATE_LIMIT_WINDOW = 60

  before_action :session_expiration, :user_setup, :check_api_rate_limit, :check_if_login_required, :set_localization, :check_password_change, :check_twofa_activation

  # Rate limits the API to Setting.rest_api_rate_limit requests per minute,

  # using the rate limiting provided by Action Controller. Requests are

  # counted per user when authenticated, per source IP otherwise, so that

  # repeated requests with invalid credentials are throttled as well.

  # Web UI requests are never throttled.

  def check_api_rate_limit

    limit = Setting.rest_api_rate_limit.to_i

    return unless api_request? && limit > 0

    rate_limiting(

      :to => limit, :within => API_RATE_LIMIT_WINDOW.seconds,

      :scope => 'api', :name => nil,

      :by => lambda {User.current.logged? ? "user/#{User.current.id}" : "ip/#{request.remote_ip}"},

      :with => lambda {render_api_rate_limit_exceeded(limit)},

      :store => Rails.cache

    )

  end

  # Renders a 429 Too Many Requests response for an API request that

  # exceeded the rate limit

  def render_api_rate_limit_exceeded(limit)

    logger.warn("API rate limit exceeded (#{request.request_method} #{request.path})") if logger

    response.headers['Retry-After'] = API_RATE_LIMIT_WINDOW.to_s

    response.headers['X-RateLimit-Limit'] = limit.to_s

    @error_messages = [l(:error_api_rate_limit_exceeded)]

    render :template => 'common/error_messages', :format => [:api], :status => :too_many_requests, :layout => nil

  end

<p><%= setting_text_field :rest_api_rate_limit, :size => 6 %></p>

  error_api_rate_limit_exceeded: "Rate limit exceeded. Please retry later."

  setting_rest_api_rate_limit: Maximum number of API requests per minute and user or IP (0 means no limit)

rest_api_rate_limit:

  format: int

  default: 0

  security_notifications: 1

# frozen_string_literal: true

# Redmine - project management software

# Copyright (C) 2006-  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require_relative '../../test_helper'

class Redmine::ApiTest::RateLimitingTest < Redmine::ApiTest::Base

  def setup

    super

    # The test environment is configured with the :null_store cache, which

    # does not keep the request counters, so use a real store instead

    Rails.stubs(:cache).returns(ActiveSupport::Cache::MemoryStore.new)

  end

  def teardown

    super

    User.current = nil

  end

  def test_api_requests_within_the_limit_should_succeed

    with_settings :rest_api_rate_limit => '3' do

      3.times do

        get '/users/current.json', :headers => credentials('jsmith')

        assert_response :ok

      end

    end

  end

  def test_api_requests_over_the_limit_should_get_429_with_rate_limit_headers

    with_settings :rest_api_rate_limit => '2' do

      2.times do

        get '/users/current.json', :headers => credentials('jsmith')

        assert_response :ok

      end

      get '/users/current.json', :headers => credentials('jsmith')

      assert_response :too_many_requests

      assert_equal '60', response.headers['Retry-After']

      assert_equal '2', response.headers['X-RateLimit-Limit']

      assert_equal ['Rate limit exceeded. Please retry later.'], response.parsed_body['errors']

    end

  end

  def test_over_the_limit_response_should_be_available_in_xml

    with_settings :rest_api_rate_limit => '1' do

      get '/users/current.xml', :headers => credentials('jsmith')

      assert_response :ok

      get '/users/current.xml', :headers => credentials('jsmith')

      assert_response :too_many_requests

      assert_equal 'application/xml', response.media_type

      assert_select 'errors error', :text => 'Rate limit exceeded. Please retry later.'

    end

  end

  def test_rate_limit_should_be_counted_per_user

    with_settings :rest_api_rate_limit => '1' do

      get '/users/current.json', :headers => credentials('jsmith')

      assert_response :ok

      get '/users/current.json', :headers => credentials('jsmith')

      assert_response :too_many_requests

      get '/users/current.json', :headers => credentials('admin')

      assert_response :ok

    end

  end

  def test_rate_limit_should_be_shared_by_all_api_controllers

    with_settings :rest_api_rate_limit => '1' do

      get '/users/current.json', :headers => credentials('jsmith')

      assert_response :ok

      get '/issues.json', :headers => credentials('jsmith')

      assert_response :too_many_requests

    end

  end

  def test_anonymous_api_requests_should_be_limited_by_ip

    with_settings :rest_api_rate_limit => '1' do

      get '/issues.json'

      assert_response :ok

      get '/issues.json'

      assert_response :too_many_requests

    end

  end

  def test_rate_limit_should_not_apply_when_disabled

    with_settings :rest_api_rate_limit => '0' do

      5.times do

        get '/users/current.json', :headers => credentials('jsmith')

        assert_response :ok

      end

    end

  end

  def test_rate_limit_should_not_apply_to_web_ui_requests

    with_settings :rest_api_rate_limit => '1' do

      3.times do

        get '/login'

        assert_response :ok

      end

    end

  end

end