nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Rate Limiting for the API - why do I see regular user accounts?

__ Jimi Wikman

We have recently activated Rate Limiting, and I am a bit surprised to see so many regular user accounts that show up, and I wonder why that would be?

I also wonder what could hide in the anonymous account, as that is a bit vague for me in the description of rate limiting.

Accepted answers

unknown

"I wonder why that would be"

... because you enable Rate Limiting. That was the whole purpose of enabling it right? To find out who has been using the REST API without limits.

"I wonder what would could hide in the anonymous account"

Nothing 'hides' in it, it's just an abstract account, as it says in the documentation...

Anonymous: This entry gathers all requests that weren’t made from an authenticated account. Since one user can easily use the limit for anonymous access, it might be a good idea to add an exemption for anonymous traffic and give it a higher limit.

If it really bothers you, disable anonymous access and be done with it. Speak to your Jira sys admins and they'll explain it to you better.

__ Jimi Wikman

If anyone else run into this, the reason why you see individual users and why you have a high number of anonymous usage is because apps and internal functionality is not compatible with the rate limiter at this time.

If you want to use it to just prevent users hammering the api to oblivion, then it works fine. You can't turn on the feature to block any api connection that is not register as an exemption, however. That will just break your solution.

I hope that helps someone else wondering about this, as it is not described or mentioned anywhere in the documentation that I have found.

All comments

unknown

"I wonder why that would be"

... because you enable Rate Limiting. That was the whole purpose of enabling it right? To find out who has been using the REST API without limits.

"I wonder what would could hide in the anonymous account"

Nothing 'hides' in it, it's just an abstract account, as it says in the documentation...

Anonymous: This entry gathers all requests that weren’t made from an authenticated account. Since one user can easily use the limit for anonymous access, it might be a good idea to add an exemption for anonymous traffic and give it a higher limit.

If it really bothers you, disable anonymous access and be done with it. Speak to your Jira sys admins and they'll explain it to you better.

__ Jimi Wikman

No need to be rude when people ask questions. It is ok if you don't know the answer, just don't reply if you have nothing helpful to add.

Of course, I will see what users are consuming data through the API, but none of the users that show up have anything to do with the API. So do they show up because of automations, apps...it does not make any sense to me.

What about Slack or Teams? Do they consume on an individual level?

Anonymous: This entry gathers all requests that weren’t made from an authenticated account. Since one user can easily use the limit for anonymous access, it might be a good idea to add an exemption for anonymous traffic and give it a higher limit.

This tells me nothing. What could connect to the API and consume data without an account? That makes no sense to me, so I would block it unless I know what it is. So, does anyone know what it could be anonymous so I know what is being blocked?

unknown

I'm sorry that you interpreted my answers as being rude.

Perhaps you'd be better off liaising with your company's Jira systems admins. They have the training and technical understanding to know how the product works, know what data flows through the REST APIs, which products and components interact with it and why those interactions would show up for 'regular users'.

Those sort of people would never turn on Rate Limiting without reading the documentation first to know exactly how it works and how to use it properly.

Good luck.

__ Jimi Wikman

I am the system admin and I have read the documentation.

The problem is that the documentation does not mention why personal accounts would show up as consumers of the API and, as you already copied in, the anonymous description does not say anything what an anonymous request could be.

Hence, my question.

Now if you do not have the answer to this, then let someone that do answer please? Preferably one of those system admins that know everything that you refer to

__ Jimi Wikman

I hope that helps someone else wondering about this, as it is not described or mentioned anywhere in the documentation that I have found.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

jira-server

rate-limit