Rate Limits

Rate limits in an HTTP API are essential for protecting services against abuse and brute force attacks by restricting the number of requests a client can make within a specified time period. By enforcing rate limits, we can mitigate the risk of unauthorized access, denial of service attacks, and excessive consumption of resources.

Limits work by setting a maximum number of requests (burst amount) allowed for a key within a specified time frame (recovery time). For example, with a limit of 30 requests and a recovery time of 5 minutes, a user can make up to 30 requests before hitting the limit. Additionally, the user receives an extra request every 10 seconds (5 * 60 / 30) until reaching the limit.

​

GraphQL/Storage/Functions

You can rate-limit the GraphQL, Storage, and Functions services independently of each other. These rate limits are based on the client IP, and requests made to one service do not count toward the rate limits of another service.

​

Configuration

[hasura.rateLimit]
limit = 100
interval = '15m'

[functions.rateLimit]
limit = 100
interval = '15m'

[storage.rateLimit]
limit = 100
interval = '15m'

​

Auth

Given that not all endpoints are equally sensitive, Auth supports more complex rate-limiting rules, allowing you to set different configurations depending on the properties of each endpoint.

¹ Paths included:

• /signin/passwordless/email
• /user/email/change
• /user/email/send-verification-email
• /user/password/reset
• /signup/email-password - If email verification enabled
• /user/deanonymize - If email verification enabled

² Paths included:

• /signin/passwordless/sms

³ Paths included:

• /signin/*
• */verify
• */otp

⁴ Paths included:

• /signup/*

​

Configuration

[auth.rateLimit]
[auth.rateLimit.emails]
limit = 10
interval = '1h'

[auth.rateLimit.sms]
limit = 10
interval = '1h'

[auth.rateLimit.bruteForce]
limit = 10
interval = '5m'

[auth.rateLimit.signups]
limit = 10
interval = '5m'

[auth.rateLimit.global]
limit = 100
interval = '1m'