diff --git a/.env.demo b/.env.demo index 4bd2b133..5f69b5f0 100644 --- a/.env.demo +++ b/.env.demo @@ -58,9 +58,9 @@ RATE_LIMITING_ENABLED=true RATE_LIMIT_DEFAULT=100/minute # Rate limit for file upload endpoints -# Lower limit to prevent resource exhaustion from large file uploads -# Default: 20 uploads per minute per IP/user -RATE_LIMIT_UPLOAD=20/minute +# Allows faster uploads while still preventing abuse +# Default: 10 uploads per second per IP/user (600/minute) +RATE_LIMIT_UPLOAD=10/second # Rate limit for document processing endpoints (OCR, metadata extraction) # These operations are resource-intensive diff --git a/app/config.py b/app/config.py index 696ab4bf..12af0fe3 100644 --- a/app/config.py +++ b/app/config.py @@ -224,7 +224,7 @@ class Settings(BaseSettings): description="Default rate limit for all endpoints (format: 'count/period', e.g., '100/minute', '1000/hour').", ) rate_limit_upload: str = Field( - default="20/minute", + default="10/second", description="Rate limit for file upload endpoints to prevent resource exhaustion.", ) rate_limit_process: str = Field( diff --git a/docs/ConfigurationGuide.md b/docs/ConfigurationGuide.md index 3fb4582f..f31c6976 100644 --- a/docs/ConfigurationGuide.md +++ b/docs/ConfigurationGuide.md @@ -121,7 +121,7 @@ Rate limits are specified in the format `count/period`, where: | **Variable** | **Description** | **Default** | **Applies To** | |------------------------|----------------------------------------------------------------------|------------------|-----------------------------------------| | `RATE_LIMIT_DEFAULT` | Default rate limit for all API endpoints | `100/minute` | Most API endpoints | -| `RATE_LIMIT_UPLOAD` | Rate limit for file upload endpoints (prevents resource exhaustion) | `20/minute` | `/api/ui-upload` and similar | +| `RATE_LIMIT_UPLOAD` | Rate limit for file upload endpoints (prevents resource exhaustion) | `10/second` | `/api/ui-upload` and similar | | `RATE_LIMIT_PROCESS` | Rate limit for processing endpoints (OCR, metadata extraction) | `30/minute` | `/api/process`, OCR endpoints | | `RATE_LIMIT_AUTH` | Stricter rate limit for authentication (prevents brute force) | `10/minute` | Login, authentication endpoints |