hitting users.getAvatar endpoint still subject to rate limiting even after disabling

[Galatoni]

Description:

After upgrade to 0.74.0 even after setting the permissions for 'api-bypass-rate-limit' and switching the dev radio button in the General -> REST API section to turn off the rate limiter, the endpoint for users.getAvatar still rate limits.

Steps to reproduce:

1. Set the above settings
2. Perform repeated API calls to the users.getAvatar end point (eg. users.getAvatar?username=homer.carter)
3. After a number of attempts, see a 400 appear with error type 'error-too-many-requests'

Expected behavior:

I expect the rate limiter to not apply and to allow me to make calls to the endpoint unimpeded.

Actual behavior:

400 error with following payload:
error: "Error, too many requests. Please slow down. You must wait 32 seconds before trying this endpoint again. [error-too-many-requests]" errorType: "error-too-many-requests" success: false

Server Setup Information:

• Version of Rocket.Chat Server: 074.0
• Operating System: Ubuntu: Welcome to Ubuntu 16.04.5 LTS (GNU/Linux 4.4.0-142-generic x86_64)
• Deployment Method: custom ansible using tarball
• Number of Running Instances: 1
• NodeJS Version: v8.15.0
• MongoDB Version: v4.0.6

[MarcosSpessatto]

@Galatoni I did the flow that you described and I'm not be able to simulate this error. The only thing different that I noticed is the error status if it is an error caused by rate limiter is 429 and not 400 🤔. Yesterday I did a PR that change some behaviors in the API rate limiter, maybe this will fix this issue.

[Galatoni]

@MarcosSpessatto I'm not a developer for the project or anything, but i'll post some screenshots of how it's set up on our project:

The user thats interacting with the interface we're using is making requests against the Spotlight search endpoint, then using the users.getAvatar endpoint to get ... well the avatar for that user. After making repeat requests (which causes the interface to refresh frequently - causing more avatar requests) eventually we end up with 400's.

I'm not saying your fixes don't fix the endpoint limits, that's fine. They look like they should. What I am saying is, with the above settings set, there shouldn't be any limits to speak of surely?

Now. What appears to be happening with your changes (feel free to correct me), but it's requesting a rebuild of the rules associated with limits. But even if I restart our server, the settings still aren't being applied, which your changes are now doing without a restart being required?

[MarcosSpessatto]

I'm not saying your fixes don't fix the endpoint limits, that's fine. They look like they should. What I am saying is, with the above settings set, there shouldn't be any limits to speak of surely?

Yes, with this permission granted to these users, yes, the rate limiter should be bypassed.

Now. What appears to be happening with your changes (feel free to correct me), but it's requesting a rebuild of the rules associated with limits. But even if I restart our server, the settings still aren't being applied, which your changes are now doing without a restart being required?

Yes, you are right. My changes just do it that you said.

I'll try to simulate this error again, this issue occurs only with this specific endpoint? Or with another ones too?

[Galatoni]

The only one i've reliably replicated this on was the users.getAvatar one. However, i've seen a number of issues regarding the users.X section in its entirety might be having issues.

[MarcosSpessatto]

@Galatoni can you please did another test? I'd like to see if you can disable the DDPRate Limiter and test again, just to make sure that the DDPRate Limiter does not affect the REST API Rate Limiter.

[Galatoni]

Ha. I'm not at my computer again until tomorrow. I'll gladly help though. Do you mind posting specific instructions to ensure I get it right? I'm not sure what you mean by DDPRate limiter for starters ;)

[MarcosSpessatto]

@Galatoni no worries, the DDP rate limiter apply rate limiter for the connections over DDP protocol(which is used too). Under the Rate Limiter menu in the admin panel, you will find the DDP Rate Limiter, below the API Rate Limiter section. (Admin -> Rate Limiter -> DDP Rate Limiter) Please disable that setting and test again if you can. Please let me know about your tests. Feel free to contact me in the rocket.chat if you want.

[Galatoni]

@MarcosSpessatto

These are the only settings I was able to find relating to what you were talking about. Searching for DDP gave me no results in the settings search box either. There is nothing by the name of DDP Rate Limiter anywhere.

Worth noting that (as above) after setting both of the other settings to "0" and restarting the server. The settings seemed to take effect and then this worked as expected. As a work around, this should allow me to continue.

[MarcosSpessatto]

@Galatoni I'll close this issue since we talked about this problem via DM, if the problem persists, feel free to reopen.