psycodepath/hrp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Feature: Add API Rate Limiting #22

New issue
Closed
opened 2026-07-04 21:54:33 +00:00 by psycodepath · 0 comments
psycodepath commented 2026-07-04 21:54:33 +00:00
Owner
Copy link

Motivation

To protect the application and database from abuse or excessive requests (DoS), we should restrict the rate of incoming API calls per client/IP/user.

Description

Implement a rate-limiting middleware using a Token Bucket or Leaky Bucket algorithm (stored in SQLite or memory) protecting the /api/v1/* routes.

User Story

As a system administrator, I want the REST API to rate-limit requests so that a buggy script or malicious user cannot overwhelm the server.

Gherkin Feature

Feature: API Rate Limiting
  As the HRP application
  I want to limit the rate of API calls from a client
  So that the server load remains stable

Acceptance Criteria

  • Rate limiting middleware protecting /api/v1/* endpoints.
  • Returns HTTP 429 Too Many Requests when limits are exceeded.
  • Rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) returned in the response.
  • Integration tests verifying rate limits are enforced.
### Motivation To protect the application and database from abuse or excessive requests (DoS), we should restrict the rate of incoming API calls per client/IP/user. ### Description Implement a rate-limiting middleware using a Token Bucket or Leaky Bucket algorithm (stored in SQLite or memory) protecting the `/api/v1/*` routes. ### User Story As a system administrator, I want the REST API to rate-limit requests so that a buggy script or malicious user cannot overwhelm the server. ### Gherkin Feature ```gherkin Feature: API Rate Limiting As the HRP application I want to limit the rate of API calls from a client So that the server load remains stable ``` ### Acceptance Criteria - [ ] Rate limiting middleware protecting `/api/v1/*` endpoints. - [ ] Returns HTTP 429 Too Many Requests when limits are exceeded. - [ ] Rate limit headers (`X-RateLimit-Limit`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`) returned in the response. - [ ] Integration tests verifying rate limits are enforced.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
chore/medium-low-hardening
security/tenant-isolation
feature/tenant-aware-auth
feature/tenant-specific-config
feature/issue-11-kernel-json-ld-support
issue/4-sessions-auth
issue/3-migrations
issue/2-database-routing
issue/1-tenant-detection
feature/integrate-behat
feat/csrf-protection
0.3.0
0.2.0
v0.1.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
v1.4.0-rest-api
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
psycodepath
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
psycodepath/hrp#22
No description provided.