diff options
| author |  tobi <31960611+tsmethurst@users.noreply.github.com> | 2023-01-02 13:10:50 +0100 |
|---|---|---|
| committer |  GitHub <noreply@github.com> | 2023-01-02 12:10:50 +0000 |
| commit | 941893a774c83802afdc4cc76e1d30c59b6c5585 (patch) | |
| tree | 6e7296146dedfeac8e83655157270f41e190724b /docs/api/ratelimiting.md | |
| parent | [chore]: Bump github.com/abema/go-mp4 from 0.8.0 to 0.9.0 (#1287) (diff) | |
| download | gotosocial-941893a774c83802afdc4cc76e1d30c59b6c5585.tar.xz | |
[chore] The Big Middleware and API Refactor (tm) (#1250)
* interim commit: start refactoring middlewares into package under router
* another interim commit, this is becoming a big job
* another fucking massive interim commit
* refactor bookmarks to new style
* ambassador, wiz zeze commits you are spoiling uz
* she compiles, we're getting there
* we're just normal men; we're just innocent men
* apiutil
* whoopsie
* i'm glad noone reads commit msgs haha :blob_sweat:
* use that weirdo go-bytesize library for maxMultipartMemory
* fix media module paths
Diffstat (limited to 'docs/api/ratelimiting.md')
| -rw-r--r-- | docs/api/ratelimiting.md | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/docs/api/ratelimiting.md b/docs/api/ratelimiting.md index a9ca07390..09b554093 100644 --- a/docs/api/ratelimiting.md +++ b/docs/api/ratelimiting.md @@ -1,10 +1,16 @@ # Rate Limit -To mitigate abuse + scraping of your instance, an IP-based HTTP rate limit is in place. +To mitigate abuse + scraping of your instance, IP-based HTTP rate limiting is in place. -This rate limit applies not just to the API, but to all requests (web, federation, etc). +There are separate rate limiters configured for different groupings of endpoints. In other words, being rate limited for one part of the API doesn't necessarily mean you will be rate limited for other parts. Each entry in the following list has a separate rate limiter: -By default, a maximum of 1000 requests in a 5 minute time window are allowed. +- `/users/*` and `/emoji/*` - ActivityPub (s2s) endpoints. +- `/auth/*` and `/oauth/*` - Sign in + OAUTH token requests. +- `/fileserver/*` - Media attachments, emojis, etc. +- `/nodeinfo/*` - NodeInfo endpoint(s). +- `/.well-known/*` - webfinger + nodeinfo requests. + +By default, each rate limiter allows a maximum of 300 requests in a 5 minute time window: 1 request per second per client IP address. Every response will include the current status of the rate limit with the following headers: |