Why ?
We want to be able to limit the volume of requests done by a single user.
This prevents bad actors / software bugs to perform unhealthy amounts of requests that might surface in eventually infra problems.
What ?
In JMAPApi count individual calls and report them toward a per user quota
jmap.properties
jmap.rate-limit.duration=10m
jmap.rate-limit.precision=2m
jmap.rate-limit.count=3000
We could do this in a Set<RequestObjectValidation> dynamically injected
interface RequestObjectValidation {
Mono<RequestObject> validate(RequestObject requestObject, mailboxSession: MailboxSession);
}
Then we could register: jmap.properties
jmap.requestObject.validations=org.apache.james.jmap.redis.RedisRateLimitRequestObjectValidation
The actual implementation can actually live in tmail-backend/tree/master/tmail-backend/jmap/extensions-redis
Why ?
We want to be able to limit the volume of requests done by a single user.
This prevents bad actors / software bugs to perform unhealthy amounts of requests that might surface in eventually infra problems.
What ?
In JMAPApi count individual calls and report them toward a per user quota
jmap.propertiesWe could do this in a
Set<RequestObjectValidation>dynamically injectedThen we could register:
jmap.propertiesThe actual implementation can actually live in tmail-backend/tree/master/tmail-backend/jmap/extensions-redis