PLAN_007 Rate limiting for authenticated users

Description

This test verifies the rate limiting functionality for authenticated users accessing the REST API.

System requirements

There are no minimum software and hardware requirements to run this test.

Preconditions

• The entire system (including the reverse proxy, REST API, and all upstream services) is deployed, operational, and accessible online.
• All communications with the REST API are conducted over HTTPS, either through a reverse proxy server or directly with the hosting server.
• Rate limit configured to 1000 requests per minute for authenticated users.

Input data

No specific data is needed to perform this test.

Steps

1. Log in with valid credentials to obtain an access token.
2. Send 1000 requests to the API within one minute using the access token.
3. Send an additional request within the same minute using the same access token.
4. Observe the response for the additional request.
5. Wait for one minute to pass.
6. Send a request after the rate limit window has reset using the same access token.

Expected outcome

• The first 1000 requests should succeed with a 200 OK status code.
• The additional request should receive an HTTP 429 Too Many Requests status code with an appropriate error message.
• The request sent after the rate limit window resets should succeed with a 200 OK status code.

Verifies software requirements

• SWR-003

Risk control for

• Preventing denial of service (DoS) attacks.
• Ensuring equitable resource distribution.

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Tester: JD-017, JD-009, JD-004
• Approver: JD-005