Commit Graph

33 Commits

Author SHA1 Message Date
Dan Ungureanu 1f2f84a6df
FIX: Add Retry-Header to rate limited responses (#11736)
It returned a 429 error code with a 'Retry-After' header if a
RateLimiter::LimitExceeded was raised and unhandled, but the header was
missing if the request was limited in the 'RequestTracker' middleware.
2021-01-19 11:35:46 +02:00
Andrew Prigorshnev 0f1c9a2180
FIX: Use the same time moment for related Redis calls in rate limiter (#11692)
Co-authored-by: Robin Ward <robin.ward@gmail.com>
2021-01-12 15:09:15 -05:00
Andrew Prigorshnev e25dd41aee
FIX: sliding window end time in rate limiter (#11691)
If the sliding window size is N seconds, then a moment at the Nth second
should be considered as the moment outside of the sliding window.

Otherwise, if the sliding window is already full, at the Nth second,
a new call wouldn't be allowed, but a time to wait before the next call
would be equal to zero, which is confusing.

In other words, the end of the time range shouldn't be included in the
sliding window.

Let's say we start at the second 0, and the sliding window size is 10
seconds. In the current version of rate limiter, this sliding window will
be considered as a time range [0, 10] (including the end of the range),
which actually is 11 seconds in length.

After this fix, the time range will be considered as [0, 10)
(excluding the end of the range), which is exactly 10 seconds in length.
2021-01-12 13:26:43 -05:00
Sam 2686d14b9a
PERF: introduce aggressive rate limiting for anonymous (#11129)
Previous to this change our anonymous rate limits acted as a throttle.
New implementation means we now also consider rate limited requests towards
the limit.

This means that if an anonymous user is hammering the server it will not be
able to get any requests through until it subsides with traffic.
2020-11-05 16:36:17 +11:00
Guo Xiang Tan 2e8075bac3
FIX: Ignore Redis readonly errors in `RateLimiter#rollback!`.
This is similar to what we're doing in `RateLimiter#performed!`.
2020-06-11 15:13:11 +08:00
Joffrey JAFFEUX 0d3d2c43a0
DEV: s/\$redis/Discourse\.redis (#8431)
This commit also adds a rubocop rule to prevent global variables.
2019-12-03 10:05:53 +01:00
Krzysztof Kotlarek 427d54b2b0 DEV: Upgrading Discourse to Zeitwerk (#8098)
Zeitwerk simplifies working with dependencies in dev and makes it easier reloading class chains. 

We no longer need to use Rails "require_dependency" anywhere and instead can just use standard 
Ruby patterns to require files.

This is a far reaching change and we expect some followups here.
2019-10-02 14:01:53 +10:00
Sam Saffron 30990006a9 DEV: enable frozen string literal on all files
This reduces chances of errors where consumers of strings mutate inputs
and reduces memory usage of the app.

Test suite passes now, but there may be some stuff left, so we will run
a few sites on a branch prior to merging
2019-05-13 09:31:32 +08:00
Sam aad7df2a1b correct return value 2018-04-25 08:44:07 +10:00
Sam 59cd7894d9 FEATURE: if site is under extreme load show anon view
If a particular path is being hit extremely hard by logged on users,
revert to anonymous cached view.

This will only come into effect if 3 requests queue for longer than 2 seconds
on a *single* path.

This can happen if a URL is shared with the entire forum base and everyone
is logged on
2018-04-18 16:58:57 +10:00
Guo Xiang Tan 81ca3677f7 Add guard for `nil` in our `RateLimiter`. 2018-03-01 13:20:42 +08:00
Guo Xiang Tan 5d9f9c2614 FIX: `RateLimiter` max of zero or less should raise rate limit exceeded. 2018-03-01 13:14:46 +08:00
Sam 4986ebcf24 FEATURE: optional default off global per ip rate limiter 2017-12-11 17:52:57 +11:00
Sam 47c44356f8 FIX: load balanced servers do not share monotonic clock
This means then when a service is load balanced and you reach rate limits
there was a case where they counting was way off

also remove the stub from clock_gettime cause we need to be super careful with
it, so we should probably just stub by hand when needed
2017-12-07 11:48:11 +11:00
Sam 5a9622163d FIX: regression around rate limiter 2017-12-04 21:44:16 +11:00
Sam dd70ef3abf Revert "Revert "PERF: improve speed of rate limiter""
This reverts commit 2373d85239.
2017-12-04 21:23:11 +11:00
Sam 2373d85239 Revert "PERF: improve speed of rate limiter"
This reverts commit a9bcdd7f27.
2017-12-04 21:19:28 +11:00
Sam a9bcdd7f27 PERF: improve speed of rate limiter
Also

- adds a global rate limiter option
- cleans up usage in tests
- fixes freeze_time so it handles clock_gettime
2017-12-04 18:17:30 +11:00
Guo Xiang Tan 5012d46cbd Add rubocop to our build. (#5004) 2017-07-28 10:20:09 +09:00
Robin Ward 5d4ee2ca1d FEATURE: Warn a user when they have few likes remaining 2016-03-18 11:30:29 -04:00
Robin Ward 0b4cb5cf0d Add better error messages for rate limits. 2015-09-24 13:52:46 -04:00
Sam a5b25ad2af FEATURE: scale up likes per day as users increase trust level
tl2 = 1.5 times the likes
tl3 = 2 times the likes
tl4 = 3 times the likes

configurable via tl[234]_additional_likes_per_day_multiplier site setting
2015-04-16 09:44:30 +10:00
Robin Ward f15b0d205f FIX: The "too similar" check happened when trying to make a post a wiki 2015-02-02 12:44:56 -05:00
Robin Ward 6e862e0e59 FIX: Should flush rate limit keys before testing it 2015-01-29 11:45:12 -05:00
Sam e0a82d3088 FIX: rate limit password reset email 2014-08-18 10:55:30 +10:00
Sam 7993845bfa add current_user_provider so people can override current_user bevior cleanly, see
http://meta.discourse.org/t/amending-current-user-logic-in-discourse/10278
2013-10-09 15:11:54 +11:00
Sam bf4bdbefe0 fix redis leak in rate limiter
change key name so there is no overlap with old non-list key
2013-05-28 08:58:45 +10:00
Matt Van Horn d5958f8779 Sliding window rate limiting
Switched the algorithm to use a circular buffer
based on a redis list
2013-05-25 12:37:28 -07:00
Matt Van Horn 247a0b3ea1 small refactor of RateLimiter for clarity 2013-05-24 13:36:33 -07:00
Sam 5ec52bd2e9 :s/moderator?/staff/g ... our naming was kind of crazy, renamed moderator? to staff 2013-05-02 17:22:27 +10:00
Sam 62c60540be pull moderator into own column, rename trust levels 2013-03-19 21:06:11 -07:00
Gosha Arinich cafc75b238 remove trailing whitespaces ❤️ 2013-02-26 07:31:35 +03:00
Robin Ward 21b5628528 Initial release of Discourse 2013-02-05 14:16:51 -05:00