Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: Github api rate limiting due to using cached token auth #360

Open
jspaleta opened this issue Apr 26, 2022 · 0 comments
Open

Bug: Github api rate limiting due to using cached token auth #360

jspaleta opened this issue Apr 26, 2022 · 0 comments

Comments

@jspaleta
Copy link

The problem.

Github has api rate limits associate with each user. The cached github auth token we are using in the api calls counts towards the api rate limit quota for the user who is associated with that token.. which might not be me..even though I'm asking the recompile and I have plenty of api ratelimit quota left.

The solution

We need to stop using a cached github token or at the very least never prefer it it.
When the recompile button is used in the UI we should use the auth token for the user logged in.. not the cached token so that the rate limiting quota for another user (the cached token's user) doesn't bite us in a weird way.

Example log from papertrail

Apr 25 20:36:33 [app/worker.1](https://my.papertrailapp.com/events?q=program%3Aapp%2Fworker.1&focus=1455452725992734727&selected=1455452725992734727) 4 TID-gphcvbz0o WARN: Octokit::TooManyRequests: GET https://api.github.com/repos/sensu/sensu-servicenow-handler/releases: 403 - API rate limit exceeded for user ID 141373. // See: https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting

This github user ID is for @calebhailey, but I'm the one making the asset recompile request using my github token. So what it looks like is happening is bonsai is using Caleb's cached token and his user account is running out of gas.

This becomes more and more problematic inside the Sensu org as both caleb and I register the bulk of internal assets which leads to draining of our api quota if several peopple are building new versions of several assets we originally created.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant