All unauthenticated requests from WMCS would currently share a single rate limit counter, the one keyed on the IP address 172.16.19.172. To avoid this, we should use the user-agent string instead. This would also incentivise bots to adhere to the UA policy. The assumption is that we don't have malicious clients on WMCS that would send us randomized user agent strings.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T399291 Epic: API Rate Limiting Architecture | |||
| Open | None | T412585 Epic: Enforce API rate limits (WE5.1.3c) | |||
| Resolved | daniel | T398919 Epic: API rate limiting dry run (WE5.1.3b) | |||
| Resolved | daniel | T410658 rest gateway: for unauthenticated requests from wmcs, use the User_agent header as the rate limit key |