diff --git a/api/config/settings/common.py b/api/config/settings/common.py index 2ed9aa4b649d35131db889513047652d277f1ca5..5c6957c11fb64957132eebb4d2c5ccbd62abbdfb 100644 --- a/api/config/settings/common.py +++ b/api/config/settings/common.py @@ -759,6 +759,10 @@ THROTTLING_RATES = { "rate": THROTTLING_USER_RATES.get("anonymous-update", "1000/day"), "description": "Anonymous PATCH and PUT requests on resource detail", }, + "subsonic": { + "rate": THROTTLING_USER_RATES.get("subsonic", "1000/hour"), + "description": "All subsonic API requests", + }, # potentially spammy / dangerous endpoints "authenticated-reports": { "rate": THROTTLING_USER_RATES.get("authenticated-reports", "100/day"), diff --git a/api/funkwhale_api/subsonic/views.py b/api/funkwhale_api/subsonic/views.py index 53861572aae7ab3ed3c3ed23f2a8b08d679f10f5..4e70f55838c8e81fee817e326fb5b270c132e408 100644 --- a/api/funkwhale_api/subsonic/views.py +++ b/api/funkwhale_api/subsonic/views.py @@ -104,6 +104,7 @@ class SubsonicViewSet(viewsets.GenericViewSet): content_negotiation_class = negotiation.SubsonicContentNegociation authentication_classes = [authentication.SubsonicAuthentication] permission_classes = [rest_permissions.IsAuthenticated] + throttling_scopes = {"*": {"authenticated": "subsonic", "anonymous": "subsonic"}} def dispatch(self, request, *args, **kwargs): if not preferences.get("subsonic__enabled"): diff --git a/changes/changelog.d/subsonic-throttling.enhancement b/changes/changelog.d/subsonic-throttling.enhancement new file mode 100644 index 0000000000000000000000000000000000000000..aad8623408c234da3d898728712a1d21cad8ae7b --- /dev/null +++ b/changes/changelog.d/subsonic-throttling.enhancement @@ -0,0 +1 @@ +Use a dedicated scope for throttling subsonic to avoid intrusive rate-limiting