PLAN_006 Rate limiting for anonymous users
Description​
This test verifies the rate limiting functionality for anonymous users accessing the REST API.
System requirements​
There are no minimum software and hardware requirements to run this test.
Preconditions​
- The entire system (including the reverse proxy, REST API, and all upstream services) is deployed, operational, and accessible online.
- All communications with the REST API are conducted over HTTPS, either through a reverse proxy server or directly with the hosting server.
- Rate limit configured to 100 requests per minute for anonymous users.
Input data​
No specific data is needed to perform this test.
Steps​
- Send 100 GET requests to the API's root endpoint within a minute.
- Send an additional request within the same minute.
- Observe the response for the additional request.
- Wait for one minute to pass.
- Send a request after the rate limit window has reset.
Expected outcome​
- The first 100 requests should succeed with a 200 OK status code.
- The additional request should receive an HTTP 429 Too Many Requests status code with an appropriate error message.
- The request sent after the rate limit window resets should succeed with a 200 OK status code.
Verifies software requirements​
- SWR-003
Risk control for​
- Preventing denial of service (DoS) attacks.
- Ensuring equitable resource distribution.
Signature meaning
The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:
- Tester: JD-017, JD-009, JD-004
- Approver: JD-005