problem: no traffic policing that keeps Forgejo available #12388

New issue

Open

opened 2026-05-03 01:51:22 +02:00 by Gusted · 0 comments

Gusted commented

2026-05-03 01:51:22 +02:00

(Migrated from codeberg.org)

Does your problem still exist on the latest Forgejo version?

Yes, the problem still exists (tested locally with the latest development version)

About your usage of Forgejo

Contributor of Forgejo
Member of the Forgejo security team.
Self-hosts Forgejo.
Co-Maintainer of Codeberg.org's Forgejo instance.

Problem description

This is issue was created as part of https://floss.social/@forgejo/116494296646568723.

If you put a Forgejo instance on the internet, there's no rate limiting, no max connections, no max timeout of a request. Even if you put it behind reverse proxy, it typically requires configuration to set such policies.

Forgejo should have some basic and simple traffic policies that can keep Forgejo available against most simple attacks that can DoS Forgejo.

Rate limiting could for example have a base that applies to all request, then you have git endpoints (blame, compare, viewing files, viewing pull request files), authentication (login, registration), archive (forgejo/forgejo#7011).

Max connections and timeout requires some work with the net/http library to make that possible and efficient.

Large instances, such as Codeberg, likely will not benefit from this due to their unique uses cases. Rate limiting with complex matching conditions, flexible timeouts. These protections are more in-scope for a proper reverse proxy that sits in front of Forgejo.

Potential workarounds

Documentation of rate limiting and overload protection for popular reverse proxies.
Simple rate limiter within Forgejo, is possible I've a patch.
Implement a server-side max timeout for each request, although likely better at reverse proxy level.

Forgejo Version

N/A

Other details about your environment (software names and versions)

N/A

Solutions

Accepted solutions to address this problem will go here

### Does your problem still exist on the latest Forgejo version? Yes, the problem still exists (tested locally with the latest development version) ### About your usage of Forgejo Contributor of Forgejo Member of the Forgejo security team. Self-hosts Forgejo. Co-Maintainer of Codeberg.org's Forgejo instance. ### Problem description This is issue was created as part of https://floss.social/@forgejo/116494296646568723. --- If you put a Forgejo instance on the internet, there's no rate limiting, no max connections, no max timeout of a request. Even if you put it behind reverse proxy, it typically requires configuration to set such policies. Forgejo should have some basic and simple traffic policies that can keep Forgejo available against most simple attacks that can DoS Forgejo. Rate limiting could for example have a base that applies to all request, then you have git endpoints (blame, compare, viewing files, viewing pull request files), authentication (login, registration), archive (forgejo/forgejo#7011). Max connections and timeout requires some work with the `net/http` library to make that possible and efficient. Large instances, such as Codeberg, likely will not benefit from this due to their unique uses cases. Rate limiting with complex matching conditions, flexible timeouts. These protections are more in-scope for a proper reverse proxy that sits in front of Forgejo. ### Potential workarounds - Documentation of rate limiting and overload protection for popular reverse proxies. - Simple rate limiter within Forgejo, is possible I've a patch. - Implement a server-side max timeout for each request, although likely better at reverse proxy level. ### Forgejo Version N/A ### Other details about your environment (software names and versions) N/A ### Solutions *Accepted solutions to address this problem will go here*

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sleepy/forgejo#12388

No description provided.

Rows
Columns