Unlimited rate limit settings can be ineffective in specific situation #201
Description
This issue was brought to our attention today:
- An API backend was configured with the rate limit set to "Unlimited requests"
- The API backend also had a role requirement set on it.
- An API key with that role assigned to it was being used to access the API, but was periodically hitting 429 rate limit errors.
After digging into this, the problem was specific to any situation where an API backend was setup with "Unlimited requests" and the user accessing it had been edited and left with the "default" rate limits applied. Only when these two requirements were met, the unlimited rate limit setting at the API backend level was effectively nullified. Any other combination of situations (custom rate limits or API users that hadn't been edited in the admin) would have worked as expected, it was just this one combination that it seemed like we weren't handling properly.