Skip to content

[BUG] Throttle classes don't set Retry-After HTTP header #1666

Description

@cpolish

Describe the bug

Throttle classes do not set the Retry-After HTTP header to either indicate the number of seconds before a request can be retried, or the timestamp after which the request can be retried.

Versions (please complete the following information):

  • Python version: 3.14
  • Django version: 6.0.2
  • Django-Ninja version: 1.5.3
  • Pydantic version: 2.12.5

Possible solution

One thing we could do is add a default exception handler for the Throttled exceptions, which add the number of seconds to retry after to a Retry-After header.

This is essentially what Django Rest Framework does:

https://github.com/encode/django-rest-framework/blob/cf38c94ec1376d2b5c875d227cefc2780aa148bd/rest_framework/views.py#L91-L92

This would work well as it appears that the _check_throttles method of the Operation class already appears to call the API instance's exception handler for the Throttled exception:

if throttle_durations:
# Filter out `None` values which may happen in case of config / rate
durations = [
duration for duration in throttle_durations if duration is not None
]
duration = max(durations, default=None)
return self.api.on_exception(request, Throttled(wait=duration)) # type: ignore

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions