Rate limits being calculated incorrectly?

[tfmorris]

Problem

Over the past couple of days, I've received a steady stream of

{
status: 429,
message: "Too Many Requests. Consider using https://openlibrary.org/developers/dumps."
}

from very simple requests issued from the standard web client with a logged in librarian account even when doing very basic things at a human powered rate of a page very couple of seconds. Even waiting a couple of minutes before revisiting a failed https://openlibrary.org/authors/merge and attempting to reload it results in a failure with no other intervening OpenLibrary activity.

This feels like the request rate is being incorrectly calculated or is set WAY too low. A single user, using the standard web client, particularly when logged in an account with editors privileges shouldn't be able to fall afoul of rate limits.

It's also odd that the error is presented as raw unformatted JSON in response to user click requesting an HTML page, but that's much less of a concern than the disruption of the incorrectly calculated rate limit.

The response indicates that it's coming from NGINX, so perhaps it doesn't recognize logged in users and is in appropriately aggregating traffic with some unrelated upstream IPs?

https://openlibrary.org/authors/OL832299A/Walter_Isaacson?merge=true&duplicates=OL10528684A,OL13279795A

https://openlibrary.org/authors/OL12738733A/Xos%C3%A9_Cobas_Brenlla

Details

{
  "log": {
    "version": "1.2",
    "creator": {
      "name": "WebInspector",
      "version": "537.36"
    },
    "pages": [
      {
        "startedDateTime": "2025-12-19T23:48:04.487Z",
        "id": "page_1",
        "title": "https://openlibrary.org/authors/OL12738733A/Xos%C3%A9_Cobas_Brenlla",
        "pageTimings": {
          "onContentLoad": 303.8310008123517,
          "onLoad": 498.5910002142191
        }
      }
    ],
    "entries": [
      {
        "_initiator": {
          "type": "other"
        },
        "_priority": "VeryHigh",
        "_resourceType": "document",
        "cache": {},
        "pageref": "page_1",
        "request": {
          "method": "GET",
          "url": "https://openlibrary.org/authors/OL12738733A/Xos%C3%A9_Cobas_Brenlla",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "DNT",
              "value": "1"
            },
            {
              "name": "Referer",
              "value": "https://openlibrary.org/authors/OL12738733A/Xos%C3%A9_Cobas_Brenlla?merge=true&duplicates=OL12738734A"
            },
            {
              "name": "Upgrade-Insecure-Requests",
              "value": "1"
            },
            {
              "name": "User-Agent",
              "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
            },
            {
              "name": "sec-ch-ua",
              "value": "\"Google Chrome\";v=\"143\", \"Chromium\";v=\"143\", \"Not A(Brand\";v=\"24\""
            },
            {
              "name": "sec-ch-ua-mobile",
              "value": "?0"
            },
            {
              "name": "sec-ch-ua-platform",
              "value": "\"macOS\""
            }
          ],
          "queryString": [],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 0
        },
        "response": {
          "status": 429,
          "statusText": "",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "content-length",
              "value": "105"
            },
            {
              "name": "content-type",
              "value": "application/json"
            },
            {
              "name": "date",
              "value": "Fri, 19 Dec 2025 23:48:04 GMT"
            },
            {
              "name": "server",
              "value": "nginx/1.28.0"
            }
          ],
          "cookies": [],
          "content": {
            "size": 105,
            "mimeType": "application/json"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": -1,
          "_transferSize": 0,
          "_error": null,
          "_fetchedViaServiceWorker": true,
          "_serviceWorkerResponseSource": "network"
        },
        "serverIPAddress": "",
        "startedDateTime": "2025-12-19T23:48:04.486Z",
        "time": 241.3599994033575,
        "timings": {
          "blocked": 2.5329992533922194,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0,
          "wait": 237.7700002505183,
          "receive": 1.0569998994469643,
          "_blocked_queueing": 0.9109992533922195,
          "_workerStart": -1,
          "_workerReady": -1,
          "_workerFetchStart": 1.622,
          "_workerRespondWithSettled": 239.284
        }
      },
      {
        "_connectionId": "2476843",
        "_initiator": {
          "type": "script",
          "stack": {
            "callFrames": [
              {
                "functionName": "fetch",
                "scriptId": "3",
                "url": "https://openlibrary.org/sw.js",
                "lineNumber": 1,
                "columnNumber": 29943
              }
            ],
            "parent": {
              "description": "await",
              "callFrames": [
                {
                  "functionName": "_handle",
                  "scriptId": "3",
                  "url": "https://openlibrary.org/sw.js",
                  "lineNumber": 1,
                  "columnNumber": 40634
                },
                {
                  "functionName": "_getResponse",
                  "scriptId": "3",
                  "url": "https://openlibrary.org/sw.js",
                  "lineNumber": 1,
                  "columnNumber": 33333
                }
              ],
              "parent": {
                "description": "await",
                "callFrames": [
                  {
                    "functionName": "handleAll",
                    "scriptId": "3",
                    "url": "https://openlibrary.org/sw.js",
                    "lineNumber": 1,
                    "columnNumber": 33161
                  },
                  {
                    "functionName": "handle",
                    "scriptId": "3",
                    "url": "https://openlibrary.org/sw.js",
                    "lineNumber": 1,
                    "columnNumber": 32910
                  },
                  {
                    "functionName": "handleRequest",
                    "scriptId": "3",
                    "url": "https://openlibrary.org/sw.js",
                    "lineNumber": 1,
                    "columnNumber": 27186
                  },
                  {
                    "functionName": "",
                    "scriptId": "3",
                    "url": "https://openlibrary.org/sw.js",
                    "lineNumber": 1,
                    "columnNumber": 26422
                  }
                ]
              }
            }
          }
        },
        "_priority": "VeryHigh",
        "_resourceType": "fetch",
        "cache": {},
        "connection": "443",
        "pageref": "page_1",
        "request": {
          "method": "GET",
          "url": "https://openlibrary.org/authors/OL12738733A/Xos%C3%A9_Cobas_Brenlla",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": ":authority",
              "value": "openlibrary.org"
            },
            {
              "name": ":method",
              "value": "GET"
            },
            {
              "name": ":path",
              "value": "/authors/OL12738733A/Xos%C3%A9_Cobas_Brenlla"
            },
            {
              "name": ":scheme",
              "value": "https"
            },
            {
              "name": "accept",
              "value": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
            },
            {
              "name": "accept-encoding",
              "value": "gzip, deflate, br, zstd"
            },
            {
              "name": "accept-language",
              "value": "en-US,en;q=0.9,fr-FR;q=0.8,fr;q=0.7"
            },
            {
              "name": "cache-control",
              "value": "no-cache"
            },
            {
              "name": "dnt",
              "value": "1"
            },
            {
              "name": "pragma",
              "value": "no-cache"
            },
            {
              "name": "priority",
              "value": "u=0, i"
            },
            {
              "name": "referer",
              "value": "https://openlibrary.org/authors/OL12738733A/Xos%C3%A9_Cobas_Brenlla?merge=true&duplicates=OL12738734A"
            },
            {
              "name": "sec-ch-ua",
              "value": "\"Google Chrome\";v=\"143\", \"Chromium\";v=\"143\", \"Not A(Brand\";v=\"24\""
            },
            {
              "name": "sec-ch-ua-mobile",
              "value": "?0"
            },
            {
              "name": "sec-ch-ua-platform",
              "value": "\"macOS\""
            },
            {
              "name": "sec-fetch-dest",
              "value": "empty"
            },
            {
              "name": "sec-fetch-mode",
              "value": "navigate"
            },
            {
              "name": "sec-fetch-site",
              "value": "same-origin"
            },
            {
              "name": "upgrade-insecure-requests",
              "value": "1"
            },
            {
              "name": "user-agent",
              "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
            }
          ],
          "queryString": [],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 0
        },
        "response": {
          "status": 429,
          "statusText": "",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "content-length",
              "value": "105"
            },
            {
              "name": "content-type",
              "value": "application/json"
            },
            {
              "name": "date",
              "value": "Fri, 19 Dec 2025 23:48:04 GMT"
            },
            {
              "name": "server",
              "value": "nginx/1.28.0"
            }
          ],
          "cookies": [],
          "content": {
            "size": 0,
            "mimeType": "application/json"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": -1,
          "_transferSize": 182,
          "_error": null,
          "_fetchedViaServiceWorker": false
        },
        "serverIPAddress": "207.241.234.205",
        "startedDateTime": "2025-12-19T23:48:04.489Z",
        "time": 233.91800001263618,
        "timings": {
          "blocked": 158.37999990528823,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0.17199999999999704,
          "wait": 74.94800018411874,
          "receive": 0.41799992322921753,
          "_blocked_queueing": 7.4789999052882195,
          "_workerStart": -1,
          "_workerReady": -1,
          "_workerFetchStart": -1,
          "_workerRespondWithSettled": -1
        }
      },
      {
        "_fromCache": "disk",
        "_initiator": {
          "type": "other"
        },
        "_priority": "High",
        "_resourceType": "other",
        "cache": {},
        "pageref": "page_1",
        "request": {
          "method": "GET",
          "url": "https://openlibrary.org/favicon.ico",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "sec-ch-ua-platform",
              "value": "\"macOS\""
            },
            {
              "name": "Referer",
              "value": "https://openlibrary.org/authors/OL12738733A/Xos%C3%A9_Cobas_Brenlla"
            },
            {
              "name": "User-Agent",
              "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
            },
            {
              "name": "sec-ch-ua",
              "value": "\"Google Chrome\";v=\"143\", \"Chromium\";v=\"143\", \"Not A(Brand\";v=\"24\""
            },
            {
              "name": "DNT",
              "value": "1"
            },
            {
              "name": "sec-ch-ua-mobile",
              "value": "?0"
            }
          ],
          "queryString": [],
          "cookies": [],
          "headersSize": -1,
          "bodySize": 0
        },
        "response": {
          "status": 200,
          "statusText": "",
          "httpVersion": "http/2.0",
          "headers": [
            {
              "name": "cache-control",
              "value": "max-age=3600"
            },
            {
              "name": "etag",
              "value": "\"6944684c-57e\""
            },
            {
              "name": "referrer-policy",
              "value": "no-referrer-when-downgrade"
            },
            {
              "name": "expires",
              "value": "Fri, 19 Dec 2025 03:01:13 GMT"
            },
            {
              "name": "accept-ranges",
              "value": "bytes"
            },
            {
              "name": "content-length",
              "value": "1406"
            },
            {
              "name": "date",
              "value": "Fri, 19 Dec 2025 02:01:13 GMT"
            },
            {
              "name": "content-type",
              "value": "image/x-icon"
            },
            {
              "name": "last-modified",
              "value": "Thu, 18 Dec 2025 20:47:08 GMT"
            },
            {
              "name": "server",
              "value": "nginx/1.28.0"
            }
          ],
          "cookies": [],
          "content": {
            "size": 1406,
            "mimeType": "image/x-icon"
          },
          "redirectURL": "",
          "headersSize": -1,
          "bodySize": 0,
          "_transferSize": 0,
          "_error": null,
          "_fetchedViaServiceWorker": true,
          "_responseCacheStorageCacheName": "misc-files-cache",
          "_serviceWorkerResponseSource": "cache-storage"
        },
        "serverIPAddress": "",
        "startedDateTime": "2025-12-19T23:48:05.012Z",
        "time": 3.792000003159046,
        "timings": {
          "blocked": 1.0679995099306105,
          "dns": -1,
          "ssl": -1,
          "connect": -1,
          "send": 0,
          "wait": 2.6340002735853196,
          "receive": 0.090000219643116,
          "_blocked_queueing": 1.0669995099306107,
          "_workerStart": 0.001,
          "_workerReady": 0.171,
          "_workerFetchStart": 0.171,
          "_workerRespondWithSettled": 2.317
        }
      }
    ]
  }
}

Reproducing the bug

1. Go to ...
2. Do ...

• Expected behavior:
• Actual behavior:

Context

• Browser (Chrome, Safari, Firefox, etc):
• OS (Windows, Mac, etc):
• Logged in (Y/N):
• Environment (prod, dev, local): prod

Breakdown

Requirements Checklist

• [ ]

Related files

Stakeholders

---

Instructions for Contributors

• Please run these commands to ensure your repository is up to date before creating a new branch to work on this issue and each time after pushing code to Github, because the pre-commit bot may add commits to your PRs upstream.

[cdrini]

I'll take a look, apologies for the interruption. The rate limit I believe you're hitting should not be applying to logged in requests. Investigating.

[cdrini]

I investigated the traffic to that author page. The 429s aren't as frequent as I feared, so putting down to P1 to investigate next week. I checked the code and logged in accounts should not be hitting that rate limit :/ I tried to recreate the traffic while logged in, and wasn't able to trigger a 429. Will investigate further next week, or tomorrow if the frequency increases or we get more reports.

I tweaked the logic a bit to try to make it less likely to hit, but that shouldn't be hitting at all when logged in.

[cdrini]

I'm noticing some funny requests like this: "GET /works/merge?records=OL33405124W,OL4288870W HTTP/2.0" 401

401 means unauthorized (aka logged out). Did you perchance do some of your work from an incongito window/logged out? Or do you maybe have some browser extension that might be doing something funny; maybe pre-fetching links on the page for some sort of processing?

[tfmorris]

I emailed my IP address. I did do one test with an incognito window during a time when I was being rate limited, but I meant to use a plain work or author URL. That does look like two works that I merged (although I would expect a POST for mutating requests not a GET), so it's possible I grabbed the wrong URL. The only browser extensions that I use are the standard ad blocking / privacy ones like Ad Block, Ghostery, Duck Duck Go. I know they block archive.org trackers, along with other trackers, but I've never seen disruptive effects from them.

This all started Thursday and has been noticeable and disruptive Thursday and Friday. Behavior can be fine for a while, but once it triggers a rate limit, it's very likely that all future requests will be rate limited for at least many minutes. The behavior doesn't seem to correlate with perceived rate of work. Requesting a second page of an authors works after perusing the first page for 15 or more seconds, with no other activity, can trigger it, which is another reason I suspect incorrect aggregation of traffic.

Requesting a different sort for an authors works can also trigger it. Here's one example that failed Friday:
https://openlibrary.org/authors/OL328088A/Carlos_Mart%C3%ADnez-Barbeito?sort=title

Did anyone make changes to nginx rules this week? Perhaps reverting the changes would make the problem go away.

[tfmorris]

I'm 99% certain these three URLs failed with 429s as well. In this case, the 2nd and 3rd requests were made within a second or two of the first.

https://openlibrary.org/authors/OL3411113A/SIGNED_inscribed_by_Author_Blank_endpaper_small_Sticker_Illustrated_with_Photos_B_W_Lee_Iacocca
https://openlibrary.org/authors/OL12789457A/John_Illustrated_with_mono_photos._Illustrator_D%27Arcy-Dawson
https://openlibrary.org/authors/OL12192523A/John_B._Kenny_Illustrator-Illustrated_with_b_w_Photos_and_Drawings

(Apologies for the book seller dreck)