diff --git a/app/lib/rate_limiter.rb b/app/lib/rate_limiter.rb index c1db3c7737..e9b7722f8a 100644 --- a/app/lib/rate_limiter.rb +++ b/app/lib/rate_limiter.rb @@ -11,7 +11,7 @@ class RateLimiter statuses: { limit: 300, - period: 1.hours.freeze, + period: 1.hour.freeze, }.freeze, reports: { diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 745eb5d3bf..3fb22c6321 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -46,7 +46,7 @@ class Rack::Attack IpBlock.blocked?(req.remote_ip) end - throttle('throttle_authenticated_api', limit: 300, period: 5.minutes) do |req| + throttle('throttle_authenticated_api', limit: 600, period: 5.minutes) do |req| req.authenticated_user_id if req.api_request? end @@ -54,11 +54,11 @@ class Rack::Attack req.remote_ip if req.api_request? && req.unauthenticated? end - throttle('throttle_api_media', limit: 30, period: 30.minutes) do |req| + throttle('throttle_api_media', limit: 100, period: 30.minutes) do |req| req.authenticated_user_id if req.post? && req.path.match?('^/api/v\d+/media') end - throttle('throttle_media_proxy', limit: 30, period: 10.minutes) do |req| + throttle('throttle_media_proxy', limit: 200, period: 10.minutes) do |req| req.remote_ip if req.path.start_with?('/media_proxy') end @@ -66,7 +66,7 @@ class Rack::Attack req.remote_ip if req.post? && req.path == '/api/v1/accounts' end - throttle('throttle_authenticated_paging', limit: 300, period: 15.minutes) do |req| + throttle('throttle_authenticated_paging', limit: 1000, period: 15.minutes) do |req| req.authenticated_user_id if req.paging_request? end @@ -77,7 +77,7 @@ class Rack::Attack API_DELETE_REBLOG_REGEX = /\A\/api\/v1\/statuses\/[\d]+\/unreblog/.freeze API_DELETE_STATUS_REGEX = /\A\/api\/v1\/statuses\/[\d]+/.freeze - throttle('throttle_api_delete', limit: 30, period: 30.minutes) do |req| + throttle('throttle_api_delete', limit: 30, period: 5.minutes) do |req| req.authenticated_user_id if (req.post? && req.path.match?(API_DELETE_REBLOG_REGEX)) || (req.delete? && req.path.match?(API_DELETE_STATUS_REGEX)) end