Regression: new check_username rate limit can block normal signup flow

sam · 10 בספטמבר,‏ 2026,‏ 6:48am

@keegan merged this 2 days ago

github.com/discourse/discourse

FIX: Stop `check_username` rate limit from blocking signup (#43316)

main ← fix-check-username-rate-limit

merged 01:10PM - 08 Sep 26 UTC

keegangeorge

+87 -27

**Previously**, `check_username` allowed 10 requests per minute per IP and surfa…ced the "slow down" error inline, so a few username edits during signup (or every keystroke on the username preference page, which had no debounce) could block the form. Anonymous callers could also probe username existence on sites where registration is closed. **In this update**, the limit is raised to 60 per minute and the endpoint fails open when throttled, matching `check_email`, since `create` re-validates on submit. Anonymous requests are refused when new registrations are disabled or DiscourseConnect is enabled, and the username preference input is debounced with a stale-response guard. | Before | After | | --- | --- | | ![before](https://github.com/user-attachments/assets/3a9d613f-fbc8-4af7-94f9-9bb77b027309) | ![after](https://github.com/user-attachments/assets/60da2eec-d98d-4a3e-a0f6-153793c4d7b4) |

Does it resolve your issue?

נושא		תגובות	צפיות
Include username on responses rate-limited by userid Feature	0	122	24 ביוני,‏ 2024
Username Availability Check Stuck During Registration Support	0	125	16 בספטמבר,‏ 2024
Username Not Available when signing up twice, first incompletely Support	8	2375	22 ביוני,‏ 2018
Username check at account creation doesn't handle CaSe properly Bug	1	870	31 באוגוסט,‏ 2016
Check_username api endpoint seems to not work correctly Support	1	1086	27 בפברואר,‏ 2018

Regression: new check_username rate limit can block normal signup flow

נושאים קשורים