Skip to content

feat(rate-limit): exempt admins and raise default limits #612

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Ahmath-Gadji merged 2 commits into from
Jul 1, 2026
Merged

feat(rate-limit): exempt admins and raise default limits #612

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
73d678a
feat(rate-limit): exempt admins and raise default limits
Ahmath-Gadji Jul 1, 2026
4a2b336
test(rate-limit): correct admin-bypass test comment
Ahmath-Gadji Jul 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions infra/compose/.env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,11 +130,14 @@ API_BASE_URL='http://X.X.X.X:APP_PORT' # Base URL of your FastAPI backe
# Max partitions a non-admin user may own (-1 = unlimited; admins bypass).
# MAX_PARTITIONS_PER_USER=100

# Rate limiting (per-worker moving window, keyed on user id then client IP)
# Rate limiting (per-worker moving window, keyed on user id then client IP).
# Admin users bypass these limits entirely. The /auth/* tier is keyed on client
# IP (callers are unauthenticated there): keep it high enough that a shared
# corporate/NAT egress IP does not throttle a legitimate login rush.
# RATE_LIMIT_ENABLED=true
# RATE_LIMIT_DEFAULT=300/minute # all paths except those below
# RATE_LIMIT_AUTH=20/minute # /auth/* (login/callback/logout)
# RATE_LIMIT_CHAT=60/minute # /v1/* (chat completions, tools)
# RATE_LIMIT_DEFAULT=600/minute # all paths except those below
# RATE_LIMIT_AUTH=60/minute # /auth/* (login/callback/logout)
# RATE_LIMIT_CHAT=120/minute # /v1/* (chat completions, tools)

# MCP SERVER
# Standalone Model Context Protocol server (openrag/api/mcp/server.py).
Expand Down
26 changes: 21 additions & 5 deletions openrag/api/middleware/rate_limit.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,12 @@
after auth populates ``request.state.user``). Limits are per-worker; use a Redis
storage to share them across workers.

Env: RATE_LIMIT_ENABLED (true), RATE_LIMIT_DEFAULT (300/minute),
RATE_LIMIT_AUTH (20/minute, /auth/*), RATE_LIMIT_CHAT (60/minute, /v1/*).
Admin users bypass rate limiting entirely, mirroring the file-quota bypass in
``api.dependencies.auth`` — trusted operators (admin UI polling, bulk scripts)
should not be throttled.

Env: RATE_LIMIT_ENABLED (true), RATE_LIMIT_DEFAULT (600/minute),
RATE_LIMIT_AUTH (60/minute, /auth/*), RATE_LIMIT_CHAT (120/minute, /v1/*).
"""

import os
Expand Down Expand Up @@ -37,9 +41,9 @@ def __init__(self, app):
super().__init__(app)
self.enabled = _env_flag("RATE_LIMIT_ENABLED", True)
self._limiter = MovingWindowRateLimiter(MemoryStorage())
self._default = parse(os.environ.get("RATE_LIMIT_DEFAULT", "300/minute"))
self._auth = parse(os.environ.get("RATE_LIMIT_AUTH", "20/minute"))
self._chat = parse(os.environ.get("RATE_LIMIT_CHAT", "60/minute"))
self._default = parse(os.environ.get("RATE_LIMIT_DEFAULT", "600/minute"))
self._auth = parse(os.environ.get("RATE_LIMIT_AUTH", "60/minute"))
self._chat = parse(os.environ.get("RATE_LIMIT_CHAT", "120/minute"))
Comment on lines +44 to +46

@coderabbitai coderabbitai Bot Jul 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

recommended rate limit per minute for login endpoints to prevent brute force

💡 Result:

There is no single "correct" rate limit for all login endpoints; the optimal configuration must be tailored to your application's expected user behavior and threat model [1][2][3]. However, authoritative security guidance from sources like OWASP recommends a layered, multi-dimensional approach rather than relying on a single IP-based limit [4][5][2]. Recommended Strategies and Best Practices: 1. Use Layered Buckets (Independent Limits) To effectively stop both targeted brute force and distributed credential stuffing, you must implement independent rate-limiting buckets that are checked separately [4][5]. If a request hits either threshold, it should be rejected [4][5]. * Per-Username Bucket: Limits attempts against any specific account, regardless of the source IP. This defends against distributed attacks where an attacker rotates through many IPs to target one account [4][5]. * Per-IP (or Per-IP+ASN) Bucket: Limits total login attempts originating from a single source (e.g., an IP address). This defends against credential-stuffing sweeps that attempt many different usernames from one location [4][5]. 2. Typical Starting Thresholds While you should tune these based on your specific traffic patterns, common starting points from industry examples include: * Per-IP: Often set between 5–10 attempts per minute [6][2][7]. Some implementations allow for a small burst (e.g., 20) to accommodate legitimate users [8][7]. * Per-Username: Often more conservative, such as 5 attempts per hour, depending on the sensitivity of the service [2][9]. * Adjustment: Start with conservative limits and gradually relax them after monitoring for false positives [6][9]. 3. Implementation Guidelines * Use Edge-Level Filtering: Perform rate limiting at the network edge (CDN, WAF, or load balancer) whenever possible [8][2][7]. This is the most efficient method because it blocks malicious traffic before it consumes application resources (like database connections or PHP workers) [8][2][7]. * Use Appropriate Algorithms: Prefer token-bucket or sliding-window algorithms [5][9][3]. Avoid simple fixed-window counters, which can be easily bypassed by bursting at the window boundary [5][3]. * State Management: In distributed or serverless environments, ensure your rate-limiting state is stored in a shared, high-performance data store like Redis [10]. In-memory counters will fail to protect against distributed attacks in multi-instance deployments [10]. * Consistent Responses: Return a generic 429 Too Many Requests status code [4][10][5]. Avoid including specific diagnostic details (such as which bucket was tripped or the number of remaining attempts) as this helps attackers refine their tools [4][5]. * Supplemental Defenses: Rate limiting alone is insufficient against sophisticated botnets [2][3]. Complement it with bot detection (device fingerprinting), CAPTCHA challenges for suspicious traffic, account lockout policies, and phishing-resistant authentication methods like passkeys [1][8][5][2][11]. Always monitor your authentication logs to distinguish between legitimate user frustration (e.g., mistyping a password) and actual attack traffic, and adjust your thresholds accordingly [6][2][12].

Citations:

🏁 Script executed:

sed -n '1,220p' openrag/api/middleware/rate_limit.py

Repository: linagora/openrag

Length of output: 4283

Tighten /auth/* throttling

The /auth/* bucket is keyed by client IP for unauthenticated requests, so 60/min leaves a high ceiling for credential-stuffing from shared egress IPs. Add a separate failed-login sub-limit, or lower this default if brute-force resistance matters here.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@openrag/api/middleware/rate_limit.py` around lines 44 - 46, The `/auth/*`
rate limit in `RateLimitMiddleware` is too permissive for unauthenticated
traffic keyed by client IP, so tighten it to better resist credential-stuffing.
Adjust the `_auth` bucket in the middleware initialization to a lower default
and/or add a dedicated failed-login limiter for the login path so repeated
failures are throttled more aggressively.

if self.enabled:
logger.info(
"Rate limiting enabled",
Expand All @@ -65,10 +69,22 @@ def _identity(request: Request) -> str:
client = request.client
return f"ip:{client.host}" if client else "ip:unknown"

@staticmethod
def _is_admin(request: Request) -> bool:
# AuthMiddleware sets request.state.user to a dict carrying "is_admin".
user = getattr(request.state, "user", None)
return bool(user.get("is_admin")) if isinstance(user, dict) else False

async def dispatch(self, request: Request, call_next):
if not self.enabled:
return await call_next(request)

# Admins bypass rate limiting entirely, mirroring the file-quota bypass
# in api.dependencies.auth. Unauthenticated paths (/auth/*) have no user
# on request.state, so this only ever exempts an authenticated admin.
if self._is_admin(request):
return await call_next(request)

path = request.url.path
limit, tier = self._limit_for(path)
identity = self._identity(request)
Expand Down
37 changes: 37 additions & 0 deletions tests/unit/api/middleware/test_rate_limit.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,5 +78,42 @@ def test_disabled_passes_through(monkeypatch):
assert client.get("/v1/chat").status_code == 200


def test_is_admin_true_for_admin_user_dict():
assert RateLimitMiddleware._is_admin(_make_request(user={"id": 1, "is_admin": True})) is True


def test_is_admin_false_for_non_admin_and_unauthenticated():
assert RateLimitMiddleware._is_admin(_make_request(user={"id": 2, "is_admin": False})) is False
assert RateLimitMiddleware._is_admin(_make_request(user=None)) is False


def test_admin_bypasses_rate_limit(monkeypatch):
# An admin user is never throttled even past a tiny limit; a non-admin on the
# same tier still gets 429. AuthMiddleware runs before this middleware and sets
# request.state.user, so we inject it via a tiny inline middleware here.
from starlette.middleware.base import BaseHTTPMiddleware

monkeypatch.setenv("RATE_LIMIT_CHAT", "1/minute")

admin = {"id": 1, "is_admin": True}

async def ok(request: Request):
return PlainTextResponse("ok")

class _InjectUser(BaseHTTPMiddleware):
async def dispatch(self, request, call_next):
request.state.user = admin
return await call_next(request)

app = Starlette(routes=[Route("/v1/chat", ok)])
# add_middleware is reverse of execution: _InjectUser (added last) runs first,
# populating request.state.user before RateLimitMiddleware sees the request.
app.add_middleware(RateLimitMiddleware)
app.add_middleware(_InjectUser)
client = TestClient(app)
for _ in range(5):
assert client.get("/v1/chat").status_code == 200


if __name__ == "__main__":
pytest.main([__file__, "-q"])
Loading