2.9 KiB
| stage | group | info | type |
|---|---|---|---|
| none | unassigned | To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments | reference, howto |
Rate limits (FREE SELF)
NOTE: For GitLab.com, please see GitLab.com-specific rate limits.
Rate limiting is a common technique used to improve the security and durability of a web application.
For example, a simple script can make thousands of web requests per second. Whether malicious, apathetic, or just a bug, your application and infrastructure may not be able to cope with the load. For more details, see Denial-of-service attack. Most cases can be mitigated by limiting the rate of requests from a single IP address.
Most brute-force attacks are similarly mitigated by a rate limit.
Admin Area settings
These are rate limits you can set in the Admin Area of your instance:
- Import/Export rate limits
- Issues rate limits
- Notes rate limits
- Protected paths
- Raw endpoints rate limits
- User and IP rate limits
- Package registry rate limits
- Git LFS rate limits
- Files API rate limits
- Deprecated API rate limits
Non-configurable limits
Repository archives
Introduced in GitLab 12.9.
There is a rate limit for downloading repository archives, which applies to the project and to the user initiating the download either through the UI or the API.
The rate limit is 5 requests per minute per user.
Webhook Testing
Introduced in GitLab 13.4.
There is a rate limit for testing webhooks, which prevents abuse of the webhook functionality.
The rate limit is 5 requests per minute per user.
Rack Attack initializer
This method of rate limiting is cumbersome, but has some advantages. It allows throttling of specific paths, and is also integrated into Git and container registry requests. See Rack Attack initializer.