[P0] Add API Rate Limiting #5

New issue

Closed

opened 2025-12-05 13:48:51 +00:00 by blightbow · 1 comment

blightbow commented

2025-12-05 13:48:51 +00:00

Owner

Problem

The API layer has no throttling configured:

No DRF throttle classes configured
No request payload size limits
Staff users can inadvertently DoS the system
Token counting on 100k char inputs with no limits

Suggested Fix

REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_RATES': {'user': '1000/hour', 'write': '100/hour'}
}

Priority

P0 — Immediate (Blocks Production)

Source

Architecture Audit 2025-12-03, Section 4: Missing Rate Limiting

## Problem The API layer has no throttling configured: - No DRF throttle classes configured - No request payload size limits - Staff users can inadvertently DoS the system - Token counting on 100k char inputs with no limits ## Suggested Fix ```python REST_FRAMEWORK = { 'DEFAULT_THROTTLE_RATES': {'user': '1000/hour', 'write': '100/hour'} } ``` ## Priority **P0 — Immediate (Blocks Production)** ## Source Architecture Audit 2025-12-03, Section 4: Missing Rate Limiting

blightbow added the

labels

2025-12-05 13:48:51 +00:00

blightbow commented

2025-12-08 05:51:29 +00:00

Author

Owner

Implementation Complete

Committed in 40e8842e5: Add API rate limiting and payload size validation

Changes

PayloadValidationMixin (api/views/base.py): dispatch() override rejects POST/PATCH/PUT requests exceeding 5MB with 413 response
AIAssistantThrottle (api/throttles.py): UserRateThrottle with 1000 requests/hour default (configurable via settings)
AssistantViewSet updated with both protections (PayloadValidationMixin first in MRO)
11 new tests covering payload validation and throttle configuration

Configuration

Default rate limiting works out of the box. To customize:

REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"] = {"ai_assistant": "500/hour"}

Note: Rate limiting requires Django cache backend for production use.

## Implementation Complete Committed in `40e8842e5`: Add API rate limiting and payload size validation ### Changes - **PayloadValidationMixin** (`api/views/base.py`): dispatch() override rejects POST/PATCH/PUT requests exceeding 5MB with 413 response - **AIAssistantThrottle** (`api/throttles.py`): UserRateThrottle with 1000 requests/hour default (configurable via settings) - **AssistantViewSet** updated with both protections (PayloadValidationMixin first in MRO) - **11 new tests** covering payload validation and throttle configuration ### Configuration Default rate limiting works out of the box. To customize: ```python REST_FRAMEWORK["DEFAULT_THROTTLE_RATES"] = {"ai_assistant": "500/hour"} ``` Note: Rate limiting requires Django cache backend for production use.

blightbow closed this issue

2025-12-08 05:51:31 +00:00

blightbow referenced this issue from a commit

2025-12-08 07:35:38 +00:00

Add API rate limiting and payload size validation