I use Discourse as a course forum, and have a bunch of scripts that I use to manage the installation through the admin API. I have an API key for an admin user and use that to perform various administrative tasks. Today I’m trying to disable a bunch of users since we are transitioning between semesters. For each student that has left the class, I first log them out and then suspend them. Unfortunately I’m having two problems: My requests are hitting some kind of internal rate limit, which it seems like I can’t control. It looks like the logic to bypass rate limiting for admins doesn’t work when you are using API keys. The offending requests are returning 500 errors rather than 429s. Here’s a snippet of the relevant logs: Started PUT "/admin/users/926/suspend?api_key=[FILTERED]&api_username=admin" for 192.17.148.54 at 2018-01-11 19:45:18 +0000 RateLimiter::LimitExceeded (RateLimiter::LimitExceeded) /var/www/discourse/lib/rate_limiter.rb:87:in `performed!' Ideally this rate limiting (a) wouldn’t be done for admin requests and (b) wouldn’t be returning the wrong error code.

I thought the rate limiter had been disabled for staff users so this might be one for the team to answer. def rate_unlimited? !!(RateLimiter.disabled? || (@user && @user.staff?)) end

[image] Geoffrey_Challen: The offending requests are returning 500 errors rather than 429s. Any ideas on this @sam?

I know—I saw this. But it doesn’t seem to be working. Hence my speculation about the API key not setting up the user properly. But that’s just a guess.

Self hosted. On tests-passed, currently v2.0.0.beta1+76.

OK this is fixed per: [image] We should never leak out exceptions in our controller tests Development I just finished pushing a rather gnarly change per: It basically replaces this pattern we used previously in tests: expect do get :index, format: :json end.to raise_error(Discourse::NotLoggedIn) With this get :index, format: :json expect(response.status).to eq(403) I made this change so our test environment is much more inline with our production environment. Previously we were leaking out a few exceptions and erroneously returning 500 status when we had a far more appropriate status… But it will take a bit for it to land cause I need to clean plugin tests. The particular reason you are getting rate limited is: config/discourse_defaults.conf main # message bus redis server port message_bus_redis_port = 6379 # message bus redis replica server address message_bus_redis_replica_host = # message bus redis slave server port message_bus_redis_replica_port = 6379 # message bus redis database message_bus_redis_db = 0 # message bus redis username message_bus_redis_username = # message bus redis password message_bus_redis_password = # skip configuring client id for cloud providers who support no client commands message_bus_redis_skip_client_commands = false if you are self hosting you can raise DISCOURSE_MAX_ADMIN_API_REQS_PER_KEY_PER_MINUTE to a higher number. We introduced this limit to protect from unintentional API abuse.

OK done, thanks! We’ll see if this helps.

500 Errors on Rate Limit When Using the Admin API Via Keys

Product Support

sam (Sam Saffron) January 11, 2018, 8:09pm 4

Are we hosting your site or are you self hosted? What version are you running?

Topic		Replies	Views
How to avoid throttling limits with admin API key? Development rest-api	11	2258	March 12, 2024
DiscourseApi::TooManyRequests rate limit? Development rest-api	2	785	February 9, 2023
Rate limits for API users Development rest-api	11	3386	March 17, 2020
How to bypass rate limiter when using an API key? Self-hosting	13	6558	September 18, 2017
Any way to turn off RateLimiter temporarily for bulk creation by admin? Development	19	1691	May 29, 2024

500 Errors on Rate Limit When Using the Admin API Via Keys

Related topics