Rate Limiting

[thehabes]

No rate limiting is present. We accept and process every HTTP request and respond. We connect to mongo for actions without limitation. This warrants some investigation into whether or not we should implement some kind of rate limiting for protection against brute force bots.

[thehabes]

Load Test Evidence (Run 4, Phase 9 — DDoS Simulation)

Phase 9 confirmed the absence of rate limiting with dramatic numbers:

• 528,858 total requests sent at 604 req/s sustained over 14.5 minutes
• 0 server errors (500s) — the server processed every single request
• Sub-scenarios:
  • HTTP Flood: 500 VUs, 3 min → ~243K requests accepted
  • Query Flood: 200 VUs hitting POST /v1/api/query with {"type":"Annotation"} → all processed
  • Payload Bomb: 100 VUs sending ~95KB bodies through full stack → all accepted
  • History Tree Attack: 50 VUs hitting /v1/history/{id} (100+ versions) → all loaded into memory
  • Query Amplification: 100 VUs with broad queries → all executed

The good news: the server survived without crashing. The bad news: a single client with no authentication can consume unlimited server resources. In the deployed environment where other applications share the RERUM API, this could impact availability for all consumers.

Note: this applies to TinyPEN and TPEN Services as well — none of the three services have rate limiting.