feat: Add rate limiting to identity search endpoint #6438

1-23-smy · 2025-12-22T07:20:57Z

Backend: Add ScopedRateThrottle to IdentityViewSet (30 req/min)
Frontend: Increase debounce from 500ms to 750ms
Config: Add IDENTITY_SEARCH_THROTTLE_RATE env variable
Tests: Add test for identity search throttling

This fixes aggressive API requests when searching for identities.

Thanks for submitting a PR! Please check the boxes below:

I have added information to docs/ if required so people know about the feature
I have filled in the Changes section below
I have filled in the How did you test this code section below
I have used a Conventional Commit title for this Pull Request

Changes

Backend Changes

api/environments/identities/views.py
Added ScopedRateThrottle to IdentityViewSet with scope identity_search
api/app/settings/common.py
Added configurable IDENTITY_SEARCH_THROTTLE_RATE environment variable (default: 30/min)

Frontend Changes

frontend/common/useDebouncedSearch.ts
Increased debounce time from 500ms to 750ms to reduce request frequency during typing

Configuration

The rate limit can be customized via environment variable:

IDENTITY_SEARCH_THROTTLE_RATE="30/min"  # default

How did you test this code?

Unit Tests

Added test_identity_search_is_throttled in
api/tests/unit/environments/identities/test_unit_identities_views.py

Manual Testing

Built a local Docker image with the changes
Made 35 rapid requests to the identity search endpoint:

for i in {1..35}; do
  curl -s -o /dev/null -w "Request $i: %{http_code}\n" \
    -H "Authorization: Token $TOKEN" \
    "http://localhost:8009/api/v1/environments/$ENV_KEY/identities/?q=test"
done

Verified that requests after the 30/min threshold return 429 Too Many Requests:

Request 33: 200
Request 34: 429  ← Rate limit triggered
Request 35: 429

- Backend: Add ScopedRateThrottle to IdentityViewSet (30 req/min) - Frontend: Increase debounce from 500ms to 750ms - Config: Add IDENTITY_SEARCH_THROTTLE_RATE env variable - Tests: Add test for identity search throttling Fixes aggressive API requests when searching for identities.

vercel · 2025-12-22T07:21:01Z

@smy-637q is attempting to deploy a commit to the Flagsmith Team on Vercel.

A member of the Team first needs to authorize it.

Copilot

Pull request overview

This PR adds rate limiting to the identity search endpoint to prevent aggressive API requests. It includes backend throttling via Django REST Framework's ScopedRateThrottle, a configurable environment variable for the rate limit, frontend debounce increase, and a test to verify throttling behavior.

Backend throttling implementation with ScopedRateThrottle at 30 requests/minute
Frontend debounce increase from 500ms to 750ms across all search components
Configurable rate limit via IDENTITY_SEARCH_THROTTLE_RATE environment variable

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
api/environments/identities/views.py	Adds `ScopedRateThrottle` with `identity_search` scope to `IdentityViewSet`
api/app/settings/common.py	Adds `IDENTITY_SEARCH_THROTTLE_RATE` environment variable configuration (default: 30/min)
api/tests/unit/environments/identities/test_unit_identities_views.py	Adds test to verify identity search throttling behavior
frontend/common/useDebouncedSearch.ts	Increases debounce time from 500ms to 750ms for all search operations

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

api/environments/identities/views.py

Copilot · 2025-12-22T07:25:27Z

api/tests/unit/environments/identities/test_unit_identities_views.py

+def test_identity_search_is_throttled(
+    admin_client: APIClient,
+    environment: Environment,
+    settings,


The test is missing the reset_cache fixture parameter which is used in other throttle tests to ensure proper cache cleanup between tests. DRF's ScopedRateThrottle uses Django's cache backend to track request counts, and without cache clearing, throttle state could persist between tests causing flaky test failures.

Add reset_cache to the function parameters (see examples in api/tests/integration/custom_auth/end_to_end/test_custom_auth_integration.py lines 486-491 and 527-533).

Suggested change

settings,

settings,

reset_cache,

Copilot · 2025-12-22T07:25:28Z

frontend/common/useDebouncedSearch.ts

+  const [debounceTime, setDebounceTime] = useState(750)

  useEffect(() => {
-    setDebounceTime(searchInput.length < 1 ? 0 : 500)
+    setDebounceTime(searchInput.length < 1 ? 0 : 750)


Increasing the debounce time from 500ms to 750ms will affect all components using useDebouncedSearch, not just identity search. This includes:

AuditLog.tsx

ConversionEventSelect.tsx

CreateSegment.tsx (segment search)

SegmentsPage.tsx

SplitTestPage.tsx

UserPage.tsx

UsersPage.tsx (identity search)

TableValueFilter.tsx

While this may be acceptable to reduce API calls globally, consider whether a 250ms increase is appropriate for all these use cases. If the intent is to only throttle identity search, consider creating a separate hook like useDebouncedIdentitySearch with the higher debounce time, or make the debounce time configurable via a parameter.

@Zaimwa9 are you able to chime in here - do you think this is something we need to be concerned about?

@1-23-smy thanks for the changes, could you explain the rationale behind the increase of the debounce? If this does not conflict with the extra throttling we'd better stick to 500. We aligned on 500 being the right UX time

- Use get_throttles() method to conditionally apply throttle only to 'list' action - Update test to use mocker.patch and reset_cache fixture for proper cleanup - Follow existing patterns from FFAdminUserViewSet and OrganisationViewSet

vercel · 2025-12-31T11:03:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
docs	Ready	Preview, Comment	Dec 31, 2025 11:09am

2 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
flagsmith-frontend-preview	Ignored	Preview	Dec 31, 2025 11:09am
flagsmith-frontend-staging	Ignored	Preview	Dec 31, 2025 11:09am

matthewelwell · 2025-12-31T11:11:49Z

@1-23-smy could you check the unit test failures here please?

1-23-smy · 2025-12-31T11:18:54Z

matthewelwell Sure, I will look into it

The test.py settings file overrides DEFAULT_THROTTLE_RATES from common.py, so identity_search scope was missing in the test environment.

1-23-smy · 2026-01-18T13:18:47Z

@1-23-smy could you check the unit test failures here please?

@matthewelwell Could you review once ?

matthewelwell · 2026-01-18T13:28:12Z

@1-23-smy could you check the unit test failures here please?

@matthewelwell Could you review once ?

Thanks - I'll take a look, but you do have some conflicts that also need resolving please.

codecov · 2026-01-18T13:32:23Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.09%. Comparing base (9468354) to head (ba7ab9c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6438   +/-   ##
=======================================
  Coverage   98.09%   98.09%           
=======================================
  Files        1293     1293           
  Lines       46610    46624   +14     
=======================================
+ Hits        45722    45736   +14     
  Misses        888      888

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

…b.com/1-23-smy/flagsmith

1-23-smy · 2026-01-18T13:42:29Z

@1-23-smy could you check the unit test failures here please?

@matthewelwell Could you review once ?

Thanks - I'll take a look, but you do have some conflicts that also need resolving please.

@matthewelwell I have fixed the conflicts. Could you please review once ?

Zaimwa9

Thanks for the contribution 👍 . 2 comments, the most important one would be to stick with the previous debounce time if you don't mind

Zaimwa9 · 2026-01-19T12:32:25Z

frontend/common/useDebouncedSearch.ts

+  const [debounceTime, setDebounceTime] = useState(750)

  useEffect(() => {
-    setDebounceTime(searchInput.length < 1 ? 0 : 500)
+    setDebounceTime(searchInput.length < 1 ? 0 : 750)


@1-23-smy thanks for the changes, could you explain the rationale behind the increase of the debounce? If this does not conflict with the extra throttling we'd better stick to 500. We aligned on 500 being the right UX time

Zaimwa9 · 2026-01-19T12:44:35Z

api/environments/identities/views.py

+        """
+        if getattr(self, "action", None) == "list":
+            return [ScopedRateThrottle()]
+        return []


Even though the impact is minimal, i would suggest to return the global default throttle super().get_throttles here (defaulting to DEFAULT_THROTTLE_CLASSES). Similarly to what we did here

@Zaimwa9

I have reverted debounce from 750ms back to 500ms (agreed UX time).

Updated get_throttles() to return super().get_throttles() for non-list actions.

thanks a lot! Just some conflicts to fix and we should be good to enable the workflows and get it over the line. Again, thanks for the contribution, we appreciate!

Thanks for the review! the conflicts should now be resolved.

Let me know if there's anything else you'd like me to adjust!

- Revert frontend debounce from 750ms back to 500ms (agreed UX time) - Return super().get_throttles() for non-list actions so global default throttle classes still apply

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

api/app/settings/common.py

api/app/settings/test.py

…entity-search-rate-limiting

Zaimwa9

Looking good to me, I allowed myself to fix some loss - probably while fixing conflicts. Thanks for the contribution!

Copilot AI review requested due to automatic review settings December 22, 2025 07:20

1-23-smy requested review from a team as code owners December 22, 2025 07:20

1-23-smy requested review from khvn26 and talissoncosta and removed request for a team December 22, 2025 07:20

Copilot started reviewing on behalf of 1-23-smy December 22, 2025 07:21 View session

github-actions bot added front-end Issue related to the React Front End Dashboard api Issue related to the REST API labels Dec 22, 2025

Copilot AI reviewed Dec 22, 2025

View reviewed changes

This comment was marked as outdated.

Sign in to view

smy-637q and others added 2 commits December 22, 2025 13:04

Merge branch 'Flagsmith:main' into feature/identity-search-rate-limiting

14dc93f

vercel bot deployed to Preview – docs December 31, 2025 11:04 View deployment

smy-637q and others added 2 commits December 31, 2025 16:49

fix: Add identity_search throttle rate to test settings

aa244d5

The test.py settings file overrides DEFAULT_THROTTLE_RATES from common.py, so identity_search scope was missing in the test environment.

Merge branch 'Flagsmith:main' into feature/identity-search-rate-limiting

a11a21e

Merge branch 'feature/identity-search-rate-limiting' of https://githu…

c207b15

…b.com/1-23-smy/flagsmith

Zaimwa9 requested changes Jan 19, 2026

View reviewed changes

smy-637q added 2 commits January 20, 2026 15:41

fix: Address reviewer feedback

b17cd1a

- Revert frontend debounce from 750ms back to 500ms (agreed UX time) - Return super().get_throttles() for non-list actions so global default throttle classes still apply

Merge branch 'main' of https://github.com/1-23-smy/flagsmith

61b5b7e

feat: re-added-master-api-key-throttle

761d0a8

cursor bot reviewed Jan 20, 2026

View reviewed changes

api/app/settings/common.py Show resolved Hide resolved

api/app/settings/test.py Show resolved Hide resolved

Zaimwa9 added 2 commits January 20, 2026 15:11

Merge branch 'main' of github.com:Flagsmith/flagsmith into feature/id…

7dbb0dc

…entity-search-rate-limiting

feat: re-added-deleted-values

ba7ab9c

Zaimwa9 approved these changes Jan 20, 2026

View reviewed changes

feat: Add rate limiting to identity search endpoint #6438

Are you sure you want to change the base?

feat: Add rate limiting to identity search endpoint #6438

Conversation

1-23-smy commented Dec 22, 2025

Changes

Backend Changes

Frontend Changes

Configuration

How did you test this code?

Unit Tests

Manual Testing

Uh oh!

vercel bot commented Dec 22, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 22, 2025

Choose a reason for hiding this comment

Uh oh!

matthewelwell Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Zaimwa9 Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

vercel bot commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

matthewelwell commented Dec 31, 2025

Uh oh!

1-23-smy commented Dec 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

1-23-smy commented Jan 18, 2026

Uh oh!

matthewelwell commented Jan 18, 2026

Uh oh!

codecov bot commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

1-23-smy commented Jan 18, 2026

Uh oh!

Zaimwa9 left a comment

Choose a reason for hiding this comment

Uh oh!

Zaimwa9 Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Zaimwa9 Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

1-23-smy Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

Zaimwa9 Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

1-23-smy Jan 20, 2026

Choose a reason for hiding this comment

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

This PR is being reviewed by Cursor Bugbot

Uh oh!

Uh oh!

Uh oh!

Zaimwa9 left a comment

Choose a reason for hiding this comment

Uh oh!

vercel bot commented Dec 31, 2025 •

edited

Loading

1-23-smy commented Dec 31, 2025 •

edited

Loading

codecov bot commented Jan 18, 2026 •

edited

Loading