RocketChat / Rocket.Chat

The communications platform that puts data protection first.
https://rocket.chat/
Other
40.09k stars 10.35k forks source link

RateLimit for users.setStatus even if disabled (globally or privilege) #20644

Open stylefish opened 3 years ago

stylefish commented 3 years ago

Description:

Hi Rocket.Chat Team, i'm calling "users.setStatus" with a separate user, lets call him "API" user, to set a status and a custom message to sync states between others systems with the rocket.chat status. This works quite well but i'm getting "please slow down" messages as response when i make some "more frequent" requests. the user which calls the function has the admin privilege and the priv to "bypass" rate limiting and i have disabled it completely in the administration with no luck: rocket.chat always tells me after a few requests that i have to slow down.

a litte side note: when the limit is reached the user whos status was set via my API call cannot change his status via the client, it seems like the rate limit counts globally and not per user.

Steps to reproduce:

  1. grant "bypass rate limit" permission or disable rate limit globally (or both)
  2. call REST API users.setStatus with status und custom message ("online", "some text") for about 10 times within 10 seconds

Expected behavior:

Actual behavior:

"please slow down" message is returned by the API, the target user of the users.setStatus call cannot change his status via client until the limit is reset.

Server Setup Information:

Client Setup Information

Additional context

no further information

Relevant logs:

no relevant log entries

Vringe commented 3 years ago

Same problem here (on 3.12.3) The user that uses the API has permission to bypass the rate limiter. Disabling or increasing the values of the API and DDP Rate Limiter via administration did not help.

Looks like it's hardcoded (5 requests in 60 seconds): https://github.com/RocketChat/Rocket.Chat/blob/157b882d38b34b7b79dea527316554fe33f70891/app/lib/server/functions/setStatusText.js#L60

stylefish commented 3 years ago

i've a really really really bad monkey patch that is applied in my update bash script for minor version updates of rocket:

echo "applying rate limit patches to rocketchat..."
sed -i 's/if (rateLimitResult.allowed) {/if (true || rateLimitResult.allowed) {/' /tmp/bundle/programs/server/app/app.js
MrMarlin commented 2 years ago

It would be very helpful to increase this limit or make it configurable.