gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-26 11:49:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): add global rate limiter for all API endpoints (#317)

Browse Source 
Apply a global rate limit of 100 requests/min per IP to all /api/ routes
in production, configurable via API_RATE_LIMIT env var. Auth endpoints
retain their existing stricter limits which stack independently.
Returns 429 Too Many Requests when exceeded.
This commit is contained in:
Anso
2026-04-01 20:12:30 -04:00
committed by GitHub
parent 19f9a1c804
commit b28ebfa6ff
4 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api-reference/overview.mdx
+13 -1
View File
@@ -88,7 +88,19 @@ This applies to all stack endpoints: read, write, deploy, down, restart, stop, s
## Rate limiting
Authentication endpoints (`/api/auth/*`) are rate-limited to **5 requests per 15 minutes** in production. API token-authenticated requests are not rate-limited.
All `/api/` endpoints are subject to a global rate limit of **100 requests per minute** per IP address. When exceeded, the server responds with `429 Too Many Requests`:
```json
{
"error": "Too many requests. Please try again shortly."
}
```
Authentication endpoints (`/api/auth/*`) have an additional, stricter limit of **5 requests per 15 minutes** to prevent brute-force attacks. Both limits apply independently — a login request counts against both the global limit and the auth limit.
The global rate limit is configurable via the `API_RATE_LIMIT` environment variable (requests per minute, default `100`).
Standard rate limit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) are included in all API responses.
## License tier requirements