the email limit rate does not work

[tigerInLuck]

I am tried use the config to control the email login verification code:

AUTH_EMAIL_LIMIT=1
AUTH_EMAIL_INTERVAL=5m

but it does not work, it sent much more emails in 1 minute.

the test log show this:

curl -i "https://mydomain.com/comments/auth/email/login?site=main-site&address=nicuseen@gmail.com&user=nicuseen"

2025/09/15 00:57:12.166 [INFO]  GET - /auth/email/login?site=main-site&address=nicuseen@gmail.com&user=nicuseen - mydomain.com - dedf4aed18f8 - 200 (51) - 693.267461ms
2025/09/15 00:57:32.354 [INFO]  GET - /auth/email/login?site=main-site&address=nicuseen@gmail.com&user=nicuseen - mydomain.com - 6417dbdbd6b2 - 200 (51) - 560.921531ms
2025/09/15 00:57:39.387 [INFO]  GET - /auth/email/login?site=main-site&address=nicuseen@gmail.com&user=nicuseen - mydomain.com - 6417dbdbd6b2 - 200 (51) - 547.10292ms
2025/09/15 00:57:42.212 [INFO]  GET - /auth/email/login?site=main-site&address=nicuseen@gmail.com&user=nicuseen - mydomain.com - fe260457164c - 200 (51) - 642.363916ms
2025/09/15 00:57:45.626 [INFO]  GET - /auth/email/login?site=main-site&address=nicuseen@gmail.com&user=nicuseen - mydomain.com - bef9b3d7a4d6 - 200 (51) - 624.552409ms

and I have received 5 emails verification.

[paskal]

Hi, there is no such limit now. https://remark42.com/docs/configuration/parameters/ has full list of currently supported params.

[paskal]

The email verification endpoint (/auth/email/login) is covered by the global rate limiter on auth routes, which is set to 2 requests per second per IP (backend/app/rest/api/rest.go:237). Your logs show requests spaced ~3-20 seconds apart from different request IDs, which would pass through the per-IP limit.

There is no per-email-address rate limiting — the current limiter only throttles by IP. Adding per-address limiting would require changes in the go-pkgz/auth library. Have you seen this problem in the real world or only in tests?