[Enhancement] API Rate Limiting Per User #12

New issue

Closed

opened 2026-03-10 03:42:27 +00:00 by Mark · 0 comments

Mark commented

2026-03-10 03:42:27 +00:00

Owner

Overview

Currently, there's basic rate limiting on the login endpoint, but there's no per-user rate limiting on API endpoints. This could lead to abuse or accidental overload.

Current State

✅ Basic rate limiting on login endpoint
❌ No per-user rate limiting on API endpoints
❌ No rate limit headers in responses
❌ No rate limit documentation

Required Implementation

1. Rate Limiting Strategy

Per-user rate limits (authenticated)
Per-IP rate limits (unauthenticated)
Different limits per endpoint sensitivity
Configurable via environment variables

2. Implementation Options

Option A: Redis-based rate limiting (scalable)
Option B: In-memory rate limiting (simpler, single instance only)

3. Rate Limit Headers

Include standard headers:

X-RateLimit-Limit
X-RateLimit-Remaining
X-RateLimit-Reset

4. Proposed Limits

Authenticated users: 100 requests/minute
Unauthenticated: 20 requests/minute
Sensitive endpoints (login): 5 requests/minute

5. Response on Limit Exceeded

HTTP 429 Too Many Requests with:

{
  "detail": "Rate limit exceeded",
  "retry_after": 60
}

Acceptance Criteria

Rate limiting middleware implemented
Per-user and per-IP limits configured
Rate limit headers included in responses
429 responses with retry-after
Configuration via environment variables
Documentation updated
Tests for rate limiting

ROADMAP.md - Phase 3 technical debt

Priority

🟡 MEDIUM

Effort Estimate

Low-Medium (1-2 days)

## Overview Currently, there's basic rate limiting on the login endpoint, but there's no per-user rate limiting on API endpoints. This could lead to abuse or accidental overload. ## Current State - ✅ Basic rate limiting on login endpoint - ❌ No per-user rate limiting on API endpoints - ❌ No rate limit headers in responses - ❌ No rate limit documentation ## Required Implementation ### 1. Rate Limiting Strategy - Per-user rate limits (authenticated) - Per-IP rate limits (unauthenticated) - Different limits per endpoint sensitivity - Configurable via environment variables ### 2. Implementation Options Option A: Redis-based rate limiting (scalable) Option B: In-memory rate limiting (simpler, single instance only) ### 3. Rate Limit Headers Include standard headers: - `X-RateLimit-Limit` - `X-RateLimit-Remaining` - `X-RateLimit-Reset` ### 4. Proposed Limits ``` Authenticated users: 100 requests/minute Unauthenticated: 20 requests/minute Sensitive endpoints (login): 5 requests/minute ``` ### 5. Response on Limit Exceeded HTTP 429 Too Many Requests with: ```json { "detail": "Rate limit exceeded", "retry_after": 60 } ``` ## Acceptance Criteria - [ ] Rate limiting middleware implemented - [ ] Per-user and per-IP limits configured - [ ] Rate limit headers included in responses - [ ] 429 responses with retry-after - [ ] Configuration via environment variables - [ ] Documentation updated - [ ] Tests for rate limiting ## Related Documents - `ROADMAP.md` - Phase 3 technical debt ## Priority 🟡 MEDIUM ## Effort Estimate Low-Medium (1-2 days)