// Prioritize by user, but fallback to IP.apiKey,ok:=r.Context().Value(apiKeyContextKey{}).(database.APIKey)if!ok {returnhttprate.KeyByIP(r)}

Note

I've prepended(User) to the rate limit error messages inRateLimitByAuthToken() to distinguish them from the genericRateLimit() function (which shares the same error message, but to catch the error we uselimit+1 onRateLimit() whilst debugging). This ensures we're actually testing the user-based rate limiting.

# Set rate limit to 5 requests per minuteexport CODER_API_RATE_LIMIT=5# Make 10 requests - should be limited after the 5thforiin {1..10};do   curl --request GET \    --url http://localhost:8080/api/v2/regions \    --header'Cookie: dev_coder_session_token=...'done

{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"message":"(User) You've been rate limited for sending more than 5 requests in 1m0s."}{"message":"(User) You've been rate limited for sending more than 5 requests in 1m0s."}{"message":"(User) You've been rate limited for sending more than 5 requests in 1m0s."}{"message":"(User) You've been rate limited for sending more than 5 requests in 1m0s."}{"message":"(User) You've been rate limited for sending more than 5 requests in 1m0s."}

# Same setup with bypass headerforiin {1..10};do   curl --request GET \    --url http://localhost:8080/api/v2/regions \    --header'Cookie: dev_coder_session_token=...' \    --header'X-Coder-Bypass-Ratelimit: true'done

{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}{"regions":[{"id":"...","name":"primary","display_name":"Default","icon_url":"/emojis/1f3e1.png","healthy":true,"path_app_url":"http://127.0.0.1:3000","wildcard_hostname":""}]}