Error-too-many-requests on updateOwnBasicInfo

skhds · November 11, 2021, 8:00am

I read on a separate issue that there is a limit on the frequency of username changes, which I think caused the issue. Unfortunately, we have a use-case that may require frequent changes on username.

My question is, is it possible to remove the limit? If so, could you show me where I could change such limit?

dudanogueira · November 11, 2021, 10:25am

I am not sure about this error specifically about changing the username.

Depending on how often you change it, if using the API, you can face api rate limits.

If that’s the case, you can change those options at:
Admin > Rate Limiter

let me know if that’s the case here.
Thanks!

skhds · November 12, 2021, 3:03am

Well, it only seems to happen when changing the username frequently.
Also, we would like to be able to set the api rate limits on server startup, so it would be helpful if you tell me where I can change the settings on the source code, if that’s possible.
I’ve been able to change some settings through apps/api/servers/settings.js, but I can’t seem to find the name for Rate Limiters…

dudanogueira · November 12, 2021, 11:01am

I don’t think it’s necessary or optimal to change the source code for tweaking the rate limit or any other settings.

If you change it from the interface, it will stay like that.

Also, you can use the API to enable or disable it, changing the setting API_Enable_Rate_Limiter to true or false accordingly and depending on your requirements and conditions, like stated here:

This is the code for API you mentioned at title (updateOwnBasicInfo)

github.com

RocketChat/Rocket.Chat/blob/c954c5ffece8111bf924bec91e6666b25a66749f/app/api/server/v1/users.js#L514

    
      
          			Meteor.runAsUser(this.userId, () => {
          				Meteor.call('setUserActiveStatus', userId, active, confirmRelinquish);
          			});
          		}
          		const { fields } = this.parseJsonQuery();
          
          
		return API.v1.success({ user: Users.findOneById(this.bodyParams.userId, { fields }) });
          	},
          });
          
          
API.v1.addRoute('users.updateOwnBasicInfo', { authRequired: true }, {
          	post() {
          		check(this.bodyParams, {
          			data: Match.ObjectIncluding({
          				email: Match.Maybe(String),
          				name: Match.Maybe(String),
          				username: Match.Maybe(String),
          				nickname: Match.Maybe(String),
          				statusText: Match.Maybe(String),
          				currentPassword: Match.Maybe(String),
          				newPassword: Match.Maybe(String),

skhds · November 15, 2021, 7:33am

It’s because we are trying to distribute the system to other platforms, rather than using it for ourselves (chat is just a part of the system). So it’s much more convenient for us to just have the settings when we deploy it instead of going through the interface every time.

Anyways, I checked lib/server/startup/settings.js for API_Enable_Rate_Limiter, and it seems that it is set to “false” (I’ll check through the API later, I don’t have the admin account yet). Is ‘API_Enable_Rate_Limiter’ the only thing that could possibly block updateOwnBasicInfo?

It just might be a side-effect of not updating the rocket.chat (the current version we are using now is 3.10.0), so I wanted to make sure before I update that no settings are getting in the way.

skhds · November 15, 2021, 8:00am

Hey, I found this while I was searching…

It says "Note: Some endpoints (like /api/v1/users.updateOwnBasicInfo ) might trigger the rate limiter and cannot currently be customized/disabled in Administration Panel "

So it looks like you do have to change the source codes to remove the limiter, since you can’t change it through Administration Panel? Or is the docs simply outdated?

skhds · November 15, 2021, 8:06am

So looking at the doc, it looks like you can add rateLimiterOptions on the part of code you’ve mentioned. Does this work even on updateOwnBasicInfo? Or maybe I should just try it out myself to see if it works…

In case it doesn’t, I’m kind of out of options, so it would be helpful if you could tell me there’s other ways to remove the limiter…

skhds · November 18, 2021, 8:38am

So, I did try putting ‘rateLimiterOptions:false’ in the fields, and this is a part of code in the build result (after doing meteor build --server-only).

which is located at /bundle/programs/server/app/app.js. So I’m certain that the parameters are passed on correctly as was specified in “https://developer.rocket.chat/reference/api/rest-api/endpoints/other-important-endpoints/rate-limiter-endpoints”, yet when I call updateOwnBasicInfo frequently, I get a 423 error saying:

So apparently, passing a rateLimiterOptions : false does not work for updateOwnBasicInfo. I would like to know if there are other ways to eliminate the limiter, or if it is simply impossible for a user to update their nickname frequently.

dudanogueira · November 18, 2021, 10:35am

Hi!

You can disable the entire Rate Limit, changing the option or giving the user the by pass rate limit permission.

I still don’t understand why you need to change the code for that.

I have a dev environment were I needed to disable this, and it has worked fine:

github.com

dudanogueira/rocket.connect/blob/master/rocket_connect/instance/management/commands/dev_settings.py#L292

    
      
              ["Livechat_secret_token", "secret_token"],
              ["Livechat_webhook_on_start", True],
              ["Livechat_webhook_on_close", True],
              ["Livechat_webhook_on_agent_message", True],
              ["Livechat_webhook_on_chat_taken", True],
              ["Livechat_webhook_on_chat_queued", True],
              ["Livechat_webhook_on_forward", True],
              ["Livechat_webhook_on_offline_msg", True],
              ["Accounts_TwoFactorAuthentication_Enabled", False],
              ["Accounts_TwoFactorAuthentication_By_Email_Enabled", False],
              ["API_Enable_Rate_Limiter", False],
              ["Log_Level", "2"],
              ["Livechat_Routing_Method", "Manual_Selection"],
          ]
          for config in configs:
              rocket.settings_update(config[0], config[1])
          
          
# create if dont exist:
          r = rocket.call_api_get(
              "integrations.get", integrationId="wppconnect-integration"
          )

Topic		Replies	Views
API error: too many requests Community Support	6	13750	March 29, 2019
One user cannot connect due to rate limit Community Support	7	243	April 9, 2024
You must set "numRequestsAllowed" property in rateLimiter for REST API endpoint Community Support	0	466	July 1, 2022
User not found [403] - Meteor.Error Community Support	3	1972	September 12, 2021
Sidebar DM and Search name user not update full name after this user change their full name Community Support rocketchat-apps	5	1199	January 22, 2024

[Rocket.Chat v7.0: Join the webinar] Roadmap Reveal: on-prem AI, VoIP, and more! Save your seat ->

Error-too-many-requests on updateOwnBasicInfo

Related topics