mirror of
https://github.com/supabase/supabase.git
synced 2026-09-22 13:37:53 +08:00
ŁUKASZ KORBASIEWICZ
8121df5b0a
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update ## What is the current behavior? The Auth rate-limit table contains stale customization statuses and time windows, omits SMS and Web3 limits, and describes the anonymous sign-in burst incorrectly. ## What is the new behavior? - Aligns documented limits with the current Auth, Studio, and Management API behavior - Documents SMS, Web3, and sign-up/sign-in request limits - Corrects verification, token, MFA, email, and anonymous sign-in details - Updates shared rate-limit values and units used by the docs ## Additional context Validation: - Prettier check - Focused MDX lint - Shared-data TypeScript check - All 16 SharedData references resolve <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Updates** * Refined authentication rate limits with clearer per-minute and per-five-minute windows. * Added rate limits for SMS, password reset requests, and Web3 sign-ups and sign-ins. * Updated sign-in, sign-up, verification, token refresh, MFA, and anonymous sign-in limits, including customizable settings where supported. * Clarified email-sending limits and OTP behavior. * **Documentation** * Updated rate-limit reference tables and guidance on request bucket capacity and sustained traffic. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
151 lines
2.9 KiB
TypeScript
151 lines
2.9 KiB
TypeScript
const config = {
|
|
auth: {
|
|
rate_limits: {
|
|
email: {
|
|
/**
|
|
* The number of emails that can be sent per hour using the inbuilt email server.
|
|
*/
|
|
inbuilt_smtp_per_hour: {
|
|
value: 2,
|
|
},
|
|
},
|
|
magic_link: {
|
|
/**
|
|
* Wait time between requests.
|
|
*/
|
|
period: {
|
|
value: 60,
|
|
unit: 'seconds',
|
|
},
|
|
/**
|
|
* How long before a Magic Link expires.
|
|
*/
|
|
validity: {
|
|
value: 1,
|
|
unit: 'hour',
|
|
},
|
|
},
|
|
otp: {
|
|
/**
|
|
* Wait time between requests.
|
|
*/
|
|
period: {
|
|
value: 60,
|
|
unit: 'seconds',
|
|
},
|
|
/**
|
|
* How long before an OTP expires.
|
|
*/
|
|
validity: {
|
|
value: 1,
|
|
unit: 'hour',
|
|
},
|
|
},
|
|
sms: {
|
|
/**
|
|
* The number of SMS messages that can be sent per hour.
|
|
*/
|
|
requests_per_hour: {
|
|
value: 30,
|
|
},
|
|
},
|
|
sign_in_sign_ups: {
|
|
/**
|
|
* The number of sign-up and sign-in requests allowed per IP address every five minutes.
|
|
*/
|
|
requests_per_five_minutes: {
|
|
value: 30,
|
|
},
|
|
requests_burst: {
|
|
value: 30,
|
|
},
|
|
},
|
|
signup_confirmation: {
|
|
/**
|
|
* Wait time between requests.
|
|
*/
|
|
period: {
|
|
value: 60,
|
|
unit: 'seconds',
|
|
},
|
|
},
|
|
password_reset: {
|
|
/**
|
|
* Wait time between requests.
|
|
*/
|
|
period: {
|
|
value: 60,
|
|
unit: 'seconds',
|
|
},
|
|
},
|
|
verification: {
|
|
requests_per_five_minutes: {
|
|
value: 30,
|
|
},
|
|
requests_burst: {
|
|
value: 30,
|
|
},
|
|
},
|
|
token_refresh: {
|
|
requests_per_five_minutes: {
|
|
value: 150,
|
|
},
|
|
requests_burst: {
|
|
value: 30,
|
|
},
|
|
},
|
|
mfa: {
|
|
requests_per_minute: {
|
|
value: 15,
|
|
},
|
|
requests_burst: {
|
|
value: 30,
|
|
},
|
|
},
|
|
web3: {
|
|
/**
|
|
* The number of Web3 sign-up and sign-in requests allowed per IP address every five minutes.
|
|
*/
|
|
requests_per_five_minutes: {
|
|
value: 30,
|
|
},
|
|
requests_burst: {
|
|
value: 30,
|
|
},
|
|
},
|
|
anonymous_signin: {
|
|
requests_per_hour: {
|
|
value: 30,
|
|
},
|
|
requests_burst: {
|
|
value: 30,
|
|
},
|
|
},
|
|
},
|
|
hook_timeouts: {
|
|
postgres_hooks: {
|
|
value: 2,
|
|
},
|
|
http_hooks: {
|
|
value: 5,
|
|
},
|
|
},
|
|
},
|
|
branching: {
|
|
inactivity_period_in_minutes: {
|
|
value: 5,
|
|
},
|
|
},
|
|
pausing: {
|
|
/**
|
|
* Inactivity period after which projects may be paused.
|
|
*/
|
|
free_tier: {
|
|
value: '1',
|
|
unit: 'week',
|
|
},
|
|
},
|
|
} as const
|
|
|
|
export default config
|