[Feature] [Extend] API Rate Limiting by User Creation Age

[6543]

extend #9559

-> the longer a user exist the less it is posible that he is evil

[jolheiser]

From the link you posted in the other issue.

problem is that accounts are created manually, then dormant, then spamming thousands of comments.

So I'm not sure how well this would work.
I think restricting the api or account creation would be a good feature, however we need to be careful how it's implemented to avoid having too many one-off security features.

[6543]

Thoughts ....:

ON first day user can only creat 5 issues | no API -> UI tell reason why cration failed if he try to set more ..
second day he can use API (~500 GET/day) and 10 Issues ....

and alter the limit if other user <- the more different the better respond to created issues ?

[6543]

@jolheiser "So I'm not sure how well this would work"
I think it would help a lot if used with restrictions to account creation

[Codeberg-org]

-> the longer a user exist the less it is posible that he is evil

This is a neat idea, can well imagine to extend this concept: reputation based on number of accepted PRs, issues not flagged as spam/deleted by project owner, number of high-quality public repos [no mirror, not single README], number of stars and repo watchers, etc.

See also hugot's gitea-api-protector, using accepted PRs as credibility score: https://codeberg.org/hugot/gitea-api-protector

[Codeberg-org]

I think restricting the api or account creation would be a good feature

This would lock out mobile Gitea apps that work via API, like for example GitNex.

[jolheiser]

I think restricting the api or account creation would be a good feature

This would lock out mobile Gitea apps that work via API, like for example GitNex.

Yes, I was talking in more general terms, and that's only half my sentence. It needs to be carefully thought out so it's not just another setting in our already large config.

Reputation is an interesting idea, and that api protector is also pretty snazzy looking.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.