PLAN_006 Rate limiting for anonymous users

Description

This test verifies the rate limiting functionality for anonymous users accessing the REST API.

System requirements

There are no minimum software and hardware requirements to run this test.

Preconditions

• The entire system (including the reverse proxy, REST API, and all upstream services) is deployed, operational, and accessible online.
• All communications with the REST API are conducted over HTTPS, either through a reverse proxy server or directly with the hosting server.
• Rate limit configured to 100 requests per minute for anonymous users.

Input data

No specific data is needed to perform this test.

Steps

1. Send 100 GET requests to the API's root endpoint within a minute.
2. Send an additional request within the same minute.
3. Observe the response for the additional request.
4. Wait for one minute to pass.
5. Send a request after the rate limit window has reset.

Expected outcome

• The first 100 requests should succeed with a 200 OK status code.
• The additional request should receive an HTTP 429 Too Many Requests status code with an appropriate error message.
• The request sent after the rate limit window resets should succeed with a 200 OK status code.

Verifies software requirements

• SWR-003

Risk control for

• Preventing denial of service (DoS) attacks.
• Ensuring equitable resource distribution.

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Tester: JD-017, JD-009, JD-004
• Approver: JD-005