[Feature] [Extend] API Rate Limiting by User Creation Age #4675

New Issue

GiteaMirror · 2025-11-02T05:59:06-06:00

GiteaMirror commented

2025-11-02 05:59:06 -06:00

Originally created by @6543 on GitHub (Jan 17, 2020).

-> the longer a user exist the less it is posible that he is evil

Originally created by @6543 on GitHub (Jan 17, 2020). extend #9559 -> the longer a user exist the less it is posible that he is evil

GiteaMirror added the issue/confirmed topic/security labels 2025-11-02 05:59:06 -06:00

GiteaMirror commented

2025-11-02 05:59:07 -06:00

@jolheiser commented on GitHub (Jan 17, 2020):

From the link you posted in the other issue.

problem is that accounts are created manually, then dormant, then spamming thousands of comments.

So I'm not sure how well this would work.
I think restricting the api or account creation would be a good feature, however we need to be careful how it's implemented to avoid having too many one-off security features.

@jolheiser commented on GitHub (Jan 17, 2020): From the link you posted in the other issue. > problem is that accounts are created manually, then dormant, then spamming thousands of comments. So I'm not sure how well this would work. I think restricting the api or account creation would be a good feature, however we need to be careful how it's implemented to avoid having too many one-off security features.

GiteaMirror commented

2025-11-02 05:59:07 -06:00

@6543 commented on GitHub (Jan 17, 2020):

Thoughts ....:

ON first day user can only creat 5 issues | no API -> UI tell reason why cration failed if he try to set more ..
second day he can use API (~500 GET/day) and 10 Issues ....

and alter the limit if other user <- the more different the better respond to created issues ?

@6543 commented on GitHub (Jan 17, 2020): Thoughts ....: ON first day user can only creat 5 issues | no API -> UI tell reason why cration failed if he try to set more .. second day he can use API (~500 GET/day) and 10 Issues .... and alter the limit if other user <- the more different the better respond to created issues ?

GiteaMirror commented

2025-11-02 05:59:07 -06:00

@6543 commented on GitHub (Jan 17, 2020):

@jolheiser "So I'm not sure how well this would work"
I think it would help a lot if used with restrictions to account creation

@6543 commented on GitHub (Jan 17, 2020): > @jolheiser "So I'm not sure how well this would work" I think it would help a lot if used with restrictions to account creation

GiteaMirror commented

2025-11-02 05:59:07 -06:00

@Codeberg-org commented on GitHub (Jan 17, 2020):

-> the longer a user exist the less it is posible that he is evil

This is a neat idea, can well imagine to extend this concept: reputation based on number of accepted PRs, issues not flagged as spam/deleted by project owner, number of high-quality public repos [no mirror, not single README], number of stars and repo watchers, etc.

See also hugot's gitea-api-protector, using accepted PRs as credibility score: https://codeberg.org/hugot/gitea-api-protector

@Codeberg-org commented on GitHub (Jan 17, 2020): > -> the longer a user exist the less it is posible that he is evil This is a neat idea, can well imagine to extend this concept: reputation based on number of accepted PRs, issues not flagged as spam/deleted by project owner, number of high-quality public repos [no mirror, not single README], number of stars and repo watchers, etc. See also hugot's gitea-api-protector, using accepted PRs as credibility score: https://codeberg.org/hugot/gitea-api-protector

GiteaMirror commented

2025-11-02 05:59:08 -06:00

@Codeberg-org commented on GitHub (Jan 17, 2020):

I think restricting the api or account creation would be a good feature

This would lock out mobile Gitea apps that work via API, like for example GitNex.

@Codeberg-org commented on GitHub (Jan 17, 2020): > I think restricting the api or account creation would be a good feature This would lock out mobile Gitea apps that work via API, like for example GitNex.

GiteaMirror commented

2025-11-02 05:59:08 -06:00

@jolheiser commented on GitHub (Jan 17, 2020):

I think restricting the api or account creation would be a good feature

This would lock out mobile Gitea apps that work via API, like for example GitNex.

Yes, I was talking in more general terms, and that's only half my sentence. It needs to be carefully thought out so it's not just another setting in our already large config.

Reputation is an interesting idea, and that api protector is also pretty snazzy looking.

@jolheiser commented on GitHub (Jan 17, 2020): > > I think restricting the api or account creation would be a good feature > > This would lock out mobile Gitea apps that work via API, like for example GitNex. Yes, I was talking in more general terms, and that's only half my sentence. It needs to be carefully thought out so it's not just _another_ setting in our already large config. Reputation is an interesting idea, and that api protector is also pretty snazzy looking.

GiteaMirror commented

2025-11-02 05:59:08 -06:00

@stale[bot] commented on GitHub (Mar 18, 2020):

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

@stale[bot] commented on GitHub (Mar 18, 2020): This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

GiteaMirror referenced this issue

2025-11-02 13:32:02 -06:00

[PR #4675] [MERGED] Fix markdown image with link #17459

GiteaMirror referenced this issue

2025-11-02 15:28:37 -06:00

[PR #5299] [MERGED] Fix markdown image with link (#4675) #17745

Sign in to join this conversation.