From 7ff6186107c62e0ec37c91f989f36755d67ee3fd Mon Sep 17 00:00:00 2001
From: mataiodoxion <226399730+mataiodoxion@users.noreply.github.com>
Date: Tue, 1 Sep 2026 10:43:34 -0700
Subject: [PATCH] fix: allow rate limit exemptions

---
 .../com/open/spring/security/RateLimitFilter.java  | 14 ++++++++++++++
 src/main/resources/application.properties          |  2 ++
 2 files changed, 16 insertions(+)

diff --git a/src/main/java/com/open/spring/security/RateLimitFilter.java b/src/main/java/com/open/spring/security/RateLimitFilter.java
index 3b044e9d..9707f750 100644
--- a/src/main/java/com/open/spring/security/RateLimitFilter.java
+++ b/src/main/java/com/open/spring/security/RateLimitFilter.java
@@ -17,6 +17,7 @@
 import java.time.Duration;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.Set;
 
 @Component
 public class RateLimitFilter extends OncePerRequestFilter {
@@ -27,10 +28,23 @@ public class RateLimitFilter extends OncePerRequestFilter {
     @Value("${security.rate-limit.admin-requests-per-minute:5000}")
     private int adminRequestsPerMinute;
 
+    @Value("${security.rate-limit.exempt-paths:}")
+    private String exemptPaths;
+
     private final Map<String, Bucket> cache = new ConcurrentHashMap<>();
     private final Map<String, Integer> userLimits = new ConcurrentHashMap<>();
     private final Map<String, Boolean> activeUsers = new ConcurrentHashMap<>();
 
+    @Override
+    protected boolean shouldNotFilter(HttpServletRequest request) {
+        String requestPath = request.getRequestURI();
+
+        return Set.of(exemptPaths.split(","))
+                .stream()
+                .map(String::trim)
+                .anyMatch(requestPath::equals);
+    }
+
     @Override
     protected void doFilterInternal(HttpServletRequest request,
                                     HttpServletResponse response,
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 1195f549..b5714e16 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -122,6 +122,8 @@ github.api.token=${GITHUB_API_TOKEN:}
 # Rate limiting: maximum requests per minute per IP
 security.rate-limit.requests-per-minute=1000
 security.rate-limit.admin-requests-per-minute=5000
+# Endpoints excluded from rate limiting
+security.rate-limit.exempt-paths=/api/jokes
 
 # ========== AWS S3 CONFIGURATION ==========
 # AWS S3 bucket name (set in .env file or environment)