Rate limit policy issue

brandon · July 9, 2021, 5:01pm

System Information

Strapi Version: v3.6.5
Operating System: Docker, strapi/base
Database: Postgres
Node Version: v12.20.1
NPM Version: v6.14.10
Yarn Version: v1.22.10

Hello,

I’m trying to use the users & permissions plugin to set rate limits for some roles and no rate limits for other roles, and for some reason I can’t get it to work. I’ve done a bunch of searching and found this issue on GitHub which fixed my initial issue of not being able to overwrite the default rate limiting:

github.com/strapi/strapi

Rate Limit change not being effective

opened 08:34PM - 12 Apr 21 UTC

closed 09:13PM - 12 Apr 21 UTC

cipiasentini

## Bug report I am still getting limited to 10 max requests per minute, even …after changing the limit on `extensions/users-permissions/config/policies/ratelimit.js` that looks like this: ``` const lazyRateLimit = { get RateLimit() { return require('koa2-ratelimit').RateLimit; }, }; module.exports = async (ctx, next) => { const message = [ { messages: [ { id: 'Auth.form.error.ratelimit', message: 'Too many attempts, please try again in a minute.', }, ], }, ]; return lazyRateLimit.RateLimit.middleware( Object.assign( {}, { interval: 1 * 60 * 1000, max: 100 , prefixKey: `${ctx.request.path}:${ctx.request.ip}`, message, }, strapi.plugins['users-permissions'].config.ratelimit ) )(ctx, next); }; ``` And just in case created a `extensions/users-permissions/config/routes.json` file that contains a route like this: ``` ..., { "method": "POST", "path": "/auth/local", "handler": "Auth.callback", "config": { "policies": ["plugins::users-permissions.ratelimit"], "prefix": "", "description": "Login a user using the identifiers email and password", "tag": { "plugin": "users-permissions", "name": "User" } } }, ... ``` ### System - Running docker-compose configuration - Node.js version: v12.18.2 - NPM version: 6.14.5 - Strapi version: 3.1.1 - Database: MongoDB - Operating system: Ubuntu 20.04

The issue I’m having now is any new policy I create and apply via the users & permissions plugin seems to be ignored and only the rateLimit policy is applied. I’m not sure if this is a bug or if I’m doing this wrong, I can’t find any documentation on this specifically.