nestjs / throttler

A rate limiting module for NestJS to work with Fastify, Express, GQL, Websockets, and RPC 🧭

Home Page:https://nestjs.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Limit not working correctly in GQL

Alechuu opened this issue · comments

Is there an existing issue for this?

  • I have searched the existing issues

Current behavior

I'm using the throttler with GraphQL and when I set the parameters to: { ttl:60, limit:10 }

I'm expecting that the Query that it's protecting should be able to get called 10 times in a span of 60 seconds.
However, it starts blocking the query at half of the limit specified.

For example, if I set limit:10 it starts sending a TooManyAttempts response at 5 attempts instead of 10.
If I set limit:1 I can't even call the Query, the throttler blocks it right away.
Tried different limits and it's always half.

Minimum reproduction code

https://gist.github.com/Alechuu/9f8b350f06c0a3981f5461dbccc79f96

Steps to reproduce

No response

Expected behavior

Expected the throttler to block requests at specified limit, instead it starts blocking at half of the specified limit.

Package version

2.0.1

NestJS version

8.0.0

Node.js version

17.6.0

In which operating systems have you tested?

  • macOS
  • Windows
  • Linux

Other

No response

Update: I have removed the following piece of code in the module where I'm importing the ThrottlerModule

{ provide: APP_GUARD, useClass: GQLThrottlerGuard },

Now it's working correctly, seems like the throttler was executing twice for some reason, thus adding a record two times instead of one.
I don't know if this is expected behavior and I just configured it incorrectly or it's a bug 🤔

The APP_GUARD is a global binding, so you had two instances of the GQLThrottlerGuard on the same route handler. Because the guards use the same underlying service for an in-memory store, so you were getting two additions per request thanks to the global and local guard