Prevent multiple calls from one internal user causing CPU overload

[digit-s2_ec_europa_eu]

Dear reader,

We are facing a problem with Jira Data Center.

We would like to prevent the software to be have multiple request coming from internal customer, that could send multiple calls to our server.

We know that there is a native max-requests settings that we can use, but the problem is that we also use Jira as a incident ticket tool.

That is to say that our Jira is called by monitoring and alerting tools which are the most important things to handle.

Having this in mind, it is then not possible for us to know in advance how many calls we get per minutes as it depends on the attacks detected by the our internal associated tools to Jira.

Then we need a solution to prevent any internal 'bruteforce' like a user making multiple calls by using a widget or the API directly,

Here an example of call to limit: 

rest/api/1.0/users/picker?showAvatar=true&query=sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss&_=1717592574471

Do you have a solution to prevent for example normal users to exceed a certain amount of call whereas we could keep the requests coming from alerting tools (bot accounts) unlimited.

Thank you in advance for your answer,

Best regards

[Laurie Sciutti]

Hello @digit-s2_ec_europa_eu ~ have you had a look at rate-limiting?  https://confluence.atlassian.com/adminjiraserver0912/improving-instance-stability-with-rate-limiting-1346048250.html 

[digit-s2_ec_europa_eu]

Hi @Laurie Sciutti ,

Thank you for the answer.

As I raised in the previous post :

"We know that there is a native max-requests settings that we can use, but the problem is that we also use Jira as a incident ticket tool."

Which means that we cannot miss any request, 

Could you please tell us what happen with the requests when the limit is reached, are the requests dropped or stored in a queue ?

Thank you; 

Best regards

[Laurie Sciutti]

@digit-s2_ec_europa_eu