.. /*
    * This file is part of the SavaPage project <https://www.savapage.org>.
    * Copyright (c) 2026 Datraverse B.V.
    * Author: Rijk Ravestein.
    *
    * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. <info@datraverse.com>
    * SPDX-License-Identifier: CC-BY-SA-4.0
    *
    * For more information, please contact Datraverse B.V. at this
    * address: info@datraverse.com
    */


.. _ch-security-rate-limiting:

Rate Limiting
-------------

`Rate Limiting <https://en.wikipedia.org/wiki/Rate_limiting>`__ with
`Token Bucket <https://en.wikipedia.org/wiki/Token_bucket>`__ algorithm
is used to suspend the processing of requests from an IP address when a
maximum number of processing failures (unauthorized access or processing
errors) has been reached within a given time period. Rate Limiting
events are reported in the Admin Web App Dashboard as 
:ref:`Real-time Activity <ch-webapp-admin-dashboard-activity>` and in the
:ref:`server.log <ch-install-on-linux-logs>`.

.. list-table:: Rate Limiting Configuration Properties
   :width: 100%
   :widths: 45 55
   :header-rows: 1
   
   * - Configuration property
     - Description

   * - system.ratelimiting.enable

     - Set to ``Y`` (default) or ``N`` to enable/disable Rate Limiting.

   * - system.ratelimiting.user-auth.enable

     - Set to ``Y`` (default) or ``N`` to  enable/disable Rate Limiting for User Authentication
       in Web Apps and the User Client Desktop Application. |br|
       |br|
       See :ref:`Login <ch-webapp-user-login>` and |RST_LINK_USER_CLIAPP|.

   * - system.ratelimiting.user-auth.failures-per-min

     - The maximum number of User Authentication failures in Web Apps per IP address
       per minute. The processing of any attempt that exceeds this maximum will be
       suspended until there is room again within the one minute time frame.
       Default: ``5``.

   * - system.ratelimiting.user-reg.enable

     - Set to ``Y`` (default) or ``N`` to enable/disable Rate Limiting for Internal
       User Self Registration. |br|
       |br|
       See :ref:`Internal Users <ch-webapp-admin-options-internal-users>`. 

   * - system.ratelimiting.user-reg.max-per-hour

     - The maximum number of User Self Registrations per IP address per hour.
       Any registration attempt that exceeds this maximum is rejected with a
       *"Registration is currently unavailable"* message, until there is room
       again within the one hour time frame. Default: ``10``.

   * - system.ratelimiting.api.enable

     - Set to ``Y`` (default) or ``N`` to enable/disable API Rate Limiting. |br|
       |br|
       See :ref:`Web Services <app-tools-webservices>`,
       :ref:`Atom Feed  Service <app-tools-savapage-atom-feed>` and
       :ref:`SavaPage as Sync Source in PaperCut <app-papercut-savapage-user-sync-auth>`.

   * - system.ratelimiting.api.failures-per-min

     - The maximum number of API failures per IP address per minute. The processing
       of any attempt that exceeds this maximum will be suspended until there is room
       again within the one minute time frame. Default: ``5``.

   * - system.ratelimiting.print-in.enable

     - Set to ``Y`` (default) or ``N`` to enable/disable Print-in Rate Limiting. |br|
       |br|
       See :ref:`Queues <ch-webapp-admin-queues>`.

   * - system.ratelimiting.print-in.failures-per-min

     - The maximum number of Print-in failures per IP address per minute. The processing
       of any attempt that exceeds this maximum will be suspended until there is room again
       within the one minute time frame. Default: ``5``.

   * - print-in.ipp.default.wait-after-failure-msec

     - A wait time in milliseconds before returning after an IPP Print-in failure.
       This causes a next request, which may result in the same failure, to be delayed.
       Default: ``5000``. |br|
       |br|
       The wait time is *only* applied if ``system.ratelimiting.print-in.enable`` = ``N``.


See |RST_LINK_CONFIG_EDITOR| on how to change these properties.