From 965ad21bbb4e68a176eb6364f84d02f04a7cb8cf Mon Sep 17 00:00:00 2001 From: Saqib Date: Thu, 3 Sep 2026 14:47:27 +0530 Subject: [PATCH] chore: remove the dead DRF throttle config that misled a diagnosis DEFAULT_THROTTLE_RATES was set to {"anon": "100/hour", "user": "1000/hour"} and had no effect whatsoever: DEFAULT_THROTTLE_CLASSES was never configured, no view declares throttle_classes, and the endpoint that actually gets hammered (/api/graphql) is a Strawberry view, not a DRF one. It was not merely inert. While diagnosing a flood of 429s on 2026-09-03 it was the first thing found, read as the cause, and very nearly "fixed" - a change that would have altered nothing while sending the investigation the wrong way. Replaced with a comment pointing at api/middleware/rate_limit.py, which is what actually runs: 5000/hour for GET, 1000/hour for other methods, keyed on the client IP from X-Forwarded-For. No behaviour change - the setting was doing nothing. --- DataSpace/settings.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/DataSpace/settings.py b/DataSpace/settings.py index 47dad67..50a38dd 100644 --- a/DataSpace/settings.py +++ b/DataSpace/settings.py @@ -301,7 +301,20 @@ "rest_framework.authentication.BasicAuthentication", ], "DEFAULT_PAGINATION_CLASS": "rest_framework.pagination.PageNumberPagination", - "DEFAULT_THROTTLE_RATES": {"anon": "100/hour", "user": "1000/hour"}, + # NOTE: there is deliberately no DEFAULT_THROTTLE_RATES here. + # + # It used to say {"anon": "100/hour", "user": "1000/hour"} and had no effect + # whatsoever: DEFAULT_THROTTLE_CLASSES was never set, no view declares + # throttle_classes, and the endpoint that actually gets hammered + # (/api/graphql) is a Strawberry view, not a DRF one. + # + # It was actively harmful. While diagnosing a flood of 429s on 2026-09-03 it + # was the first thing found, read as the cause, and very nearly "fixed" - + # which would have changed nothing and sent the investigation the wrong way. + # + # Real rate limiting lives in api/middleware/rate_limit.py (registered in + # MIDDLEWARE above): 5000/hour for GET, 1000/hour for other methods, keyed on + # the client IP from X-Forwarded-For. Change limits there. "DEFAULT_FILTER_BACKENDS": ["django_filters.rest_framework.DjangoFilterBackend"], "PAGE_SIZE": 10, }