-
Bug
-
Resolution: Fixed
-
Low
-
8.6.0
-
8.06
-
10
-
Severity 3 - Minor
-
3
-
Issue Summary
Jira REST endpoint responses contain 'setCookies' header. In case of using REST client that includes cookies in subsequent request by default, rate limiting will no longer apply to these requests because they will contain characteristics classifying them as originating from UI traffic.
The affected clients may include not only client applications like Postman but also rest client libraries for programming languages.
Steps to Reproduce
Prerequisite: REST calls performed using Postman
- Start Jira DC Node
- Set rate limit to allow 1 request per 1 minute with burst size 1
- Send a request to rest/api/2/myself with basic authentication
- Observe that it's not rate limited but it response does contain rate limiting headers (X-RateLimit-Remaining - 0 being most significant)
- Repeat the request from 3. within 60 seconds
Expected Results
Request gets rate limited. Response headers contain correct information about rate limiting
Actual Results
Request does not get rate limited and its response does not contain rate limiting information
Workaround
Depending on the REST client app/library used, disabling cookie preservation for subsequent requests causes the requests be correctly rate limited.
- mentioned in
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...
-
Page Loading...