From 8af8da09d0d25d25b5977b7c74da364e6fbec5fa Mon Sep 17 00:00:00 2001 From: Michael Kozono Date: Fri, 23 Aug 2019 12:52:53 -0700 Subject: Note some JWT requests aren't rate limited --- doc/security/rack_attack.md | 2 ++ doc/user/gitlab_com/index.md | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/doc/security/rack_attack.md b/doc/security/rack_attack.md index b99bfb16829..4ad5fd0d16c 100644 --- a/doc/security/rack_attack.md +++ b/doc/security/rack_attack.md @@ -81,6 +81,8 @@ This limit is reset by requests that authenticate successfully. For example, 29 failed authentication requests followed by 1 successful request, followed by 29 more failed authentication requests would not trigger a ban. +JWT requests authenticated by gitlab-ci-token are excluded from this limit. + No response headers are provided. ## Settings diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md index af37cc896ad..8f1048260f2 100644 --- a/doc/user/gitlab_com/index.md +++ b/doc/user/gitlab_com/index.md @@ -314,7 +314,7 @@ Source: #### Git and container registry failed authentication ban -GitLab.com responds with HTTP status code 403 for 1 hour, if 30 failed +GitLab.com responds with HTTP status code `403` for 1 hour, if 30 failed authentication requests were received in a 3-minute period from a single IP address. This applies only to Git requests and container registry (`/jwt/auth`) requests @@ -324,6 +324,8 @@ This limit is reset by requests that authenticate successfully. For example, 29 failed authentication requests followed by 1 successful request, followed by 29 more failed authentication requests would not trigger a ban. +JWT requests authenticated by gitlab-ci-token are excluded from this limit. + No response headers are provided. ### Admin Area settings -- cgit v1.2.1