summaryrefslogtreecommitdiff
path: root/doc/security/rate_limits.md
diff options
context:
space:
mode:
Diffstat (limited to 'doc/security/rate_limits.md')
-rw-r--r--doc/security/rate_limits.md29
1 files changed, 28 insertions, 1 deletions
diff --git a/doc/security/rate_limits.md b/doc/security/rate_limits.md
index 9d49297c9de..14fc526ca7e 100644
--- a/doc/security/rate_limits.md
+++ b/doc/security/rate_limits.md
@@ -1,6 +1,6 @@
---
stage: Manage
-group: Access
+group: Authentication & Authorization
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
type: reference, howto
---
@@ -87,6 +87,33 @@ There is a rate limit for [testing webhooks](../user/project/integrations/webhoo
The **rate limit** is 5 requests per minute per user.
+### Users sign up
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77835) in GitLab 14.7.
+
+There is a rate limit per IP address on the `/users/sign_up` endpoint. This is to mitigate attempts to misuse the endpoint. For example, to mass
+discover usernames or email addresses in use.
+
+The **rate limit** is 20 calls per minute per IP address.
+
+### Update username
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77221) in GitLab 14.7.
+
+There is a rate limit on the update username action. This is enforced to mitigate misuse of the feature. For example, to mass discover
+which usernames are in use.
+
+The **rate limit** is 10 calls per minute per signed-in user.
+
+### Username exists
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/77119) in GitLab 14.7.
+
+There is a rate limit for the internal endpoint `/users/:username/exists`, used by registration to perform a client-side validation for
+uniqueness of the chosen username. This is to mitigate the risk of misuses, such as mass discovery of usernames in use.
+
+The **rate limit** is 20 calls per minute per IP address.
+
## Troubleshooting
### Rack Attack is denylisting the load balancer