From 5935e441fa5052f236e7ad0bed6f03b1910904d5 Mon Sep 17 00:00:00 2001 From: Alex Gaillard Date: Fri, 14 Aug 2026 11:09:35 -0400 Subject: [PATCH 1/2] Document WebSocket rate limiter env variables Co-Authored-By: Claude Opus 4.8 (1M context) --- content/configuration/security-limits.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/configuration/security-limits.md b/content/configuration/security-limits.md index 4689fb62..9d31b9be 100644 --- a/content/configuration/security-limits.md +++ b/content/configuration/security-limits.md @@ -164,6 +164,18 @@ You can use the built-in email rate-limiter for flow operations. Unlike the queu | `RATE_LIMITER_EMAIL_FLOWS_DURATION` | The time window in seconds in which the points are counted. | `60` | | `RATE_LIMITER_EMAIL_FLOWS_ERROR_MESSAGE` | A custom error message which is appended to the rate limit error. | `''` | +### WebSocket Rate Limiting + +You can rate limit the number of messages a client can send over a WebSocket connection. WebSocket rate limiting is turned on or off by the main `RATE_LIMITER_ENABLED` flag, and there is no separate enable flag. + +| Variable | Description | Default Value | +| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | ------------- | +| `RATE_LIMITER_WEBSOCKETS_POINTS` | Number of allowed WebSocket messages per client in each duration window. | `50` | +| `RATE_LIMITER_WEBSOCKETS_DURATION` | Length of the window in seconds for WebSocket message rate limiting. | `1` | +| `RATE_LIMITER_WEBSOCKETS_KEY_PREFIX` | Prefix applied to the WebSocket limiter's Redis keys. Override this when a shared Redis instance scopes each project's access by key prefix. | `websocket` | + +The store and Redis connection are shared with the main rate limiter, so the WebSocket limiter uses the same `RATE_LIMITER_STORE` and `REDIS` configuration. The defaults of 50 points per 1 second match the previous built-in behavior, so existing setups are unaffected unless you set the new variables. + ## Limits & Optimizations Allows you to configure hard technical limits, to prevent abuse and optimize for your particular server environment. From 2d78f8b7047b2d592e997e791dacecd356b924e6 Mon Sep 17 00:00:00 2001 From: Alex Gaillard Date: Fri, 14 Aug 2026 16:03:41 -0400 Subject: [PATCH 2/2] Clarify WebSocket rate limiter inherits main RATE_LIMITER_* settings Co-Authored-By: Claude Opus 4.8 (1M context) --- content/configuration/security-limits.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/content/configuration/security-limits.md b/content/configuration/security-limits.md index 9d31b9be..da34e2ef 100644 --- a/content/configuration/security-limits.md +++ b/content/configuration/security-limits.md @@ -166,15 +166,15 @@ You can use the built-in email rate-limiter for flow operations. Unlike the queu ### WebSocket Rate Limiting -You can rate limit the number of messages a client can send over a WebSocket connection. WebSocket rate limiting is turned on or off by the main `RATE_LIMITER_ENABLED` flag, and there is no separate enable flag. +You can rate limit the number of messages a client can send over a WebSocket connection. The WebSocket message rate limiter inherits all `RATE_LIMITER_*` settings (store, points, duration, Redis connection) and is enabled by the same `RATE_LIMITER_ENABLED` flag. There is no separate enable flag. -| Variable | Description | Default Value | -| ------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------- | ------------- | -| `RATE_LIMITER_WEBSOCKETS_POINTS` | Number of allowed WebSocket messages per client in each duration window. | `50` | -| `RATE_LIMITER_WEBSOCKETS_DURATION` | Length of the window in seconds for WebSocket message rate limiting. | `1` | -| `RATE_LIMITER_WEBSOCKETS_KEY_PREFIX` | Prefix applied to the WebSocket limiter's Redis keys. Override this when a shared Redis instance scopes each project's access by key prefix. | `websocket` | +Any `RATE_LIMITER_WEBSOCKETS_*` variable overrides the matching `RATE_LIMITER_*` value for WebSocket connections only. -The store and Redis connection are shared with the main rate limiter, so the WebSocket limiter uses the same `RATE_LIMITER_STORE` and `REDIS` configuration. The defaults of 50 points per 1 second match the previous built-in behavior, so existing setups are unaffected unless you set the new variables. +| Variable | Description | Default Value | +| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | +| `RATE_LIMITER_WEBSOCKETS_POINTS` | Overrides `RATE_LIMITER_POINTS` for WebSocket connections - allowed messages per client per window. | Inherits `RATE_LIMITER_POINTS` | +| `RATE_LIMITER_WEBSOCKETS_DURATION` | Overrides `RATE_LIMITER_DURATION` for WebSocket connections - window length in seconds. | Inherits `RATE_LIMITER_DURATION` | +| `RATE_LIMITER_WEBSOCKETS_KEY_PREFIX` | Prefix for the WebSocket limiter's Redis keys. Override this when a shared Redis instance scopes each project's access by key prefix. | `websocket` | ## Limits & Optimizations