mastodon / mastodon

Your self-hosted, globally interconnected microblogging community
https://joinmastodon.org
GNU Affero General Public License v3.0
46.78k stars 6.9k forks source link

Configurable rate limits for authenticated users (server setting) #22217

Open mdesmedt opened 1 year ago

mdesmedt commented 1 year ago

Pitch

I am self-hosting a single-user instance and am experiencing rate limiting errors simply by browsing my timeline on the web interface, while the server has plenty of resources to spare. Perhaps I have too many tabs open? Whatever the case, I have plenty of server processing resources. So I'd like to have configurable rate limits for authenticated users.

The most straightforward implementation for this seems two new server settings which control throttle_authenticated_api and throttle_authenticated_paging in https://github.com/mastodon/mastodon/blob/main/config/initializers/rack_attack.rb

This is related to PR https://github.com/mastodon/mastodon/pull/21693 but I am suggesting a different approach. Letting admins tweak these settings instead of whitelisting users/roles/IPs.

Motivation

Users/Admins on single-user or small instances would benefit from either more generous rate limits (no more "Too many requests. Rate limit reached" errors while just browsing the timeline).

ineffyble commented 1 year ago

I have the same problem, I leave too many tabs open for my single-user instance and throttle myself.

flancian commented 1 year ago

Same here / +1. As a user I find it particularly frustrating not to be able to load more of the timeline, and particularly my notifications, when this happens. Having rate limiting be action-aware, and throttling some actions but not others (at first?) seems ideal maybe; I needed to retrieve something from my notifications just now and having to wait five minutes for it made me feel I couldn't trust Mastodon to give me back the information I thought it was willing to serve to me when I needed it. 2023-02-17T00:40:49,972140273+01:00

politas commented 5 days ago

Can we make sure that if this is implemented is isn't tied to "single user" servers? I have four users on my server, so it works pretty much like a single user server as far as load, but doesn't use the "single user" settings.