From 25ffb8684cf1c2d9dbd6abeda169cfacd308d6a0 Mon Sep 17 00:00:00 2001
From: Hellgren Heikki <heikki.hellgren@op.fi>
Date: Thu, 27 Feb 2025 15:15:13 +0200
Subject: [PATCH] chore: add mention about plugin rate limit to changeset

Signed-off-by: Hellgren Heikki <heikki.hellgren@op.fi>
---
 .changeset/famous-terms-rescue.md             | 12 +++++
 .changeset/sour-comics-attend.md              |  5 ---
 .../core-services/http-router.md              | 44 +++++++++++++++++++
 .../http/createRateLimitMiddleware.ts         |  2 +-
 4 files changed, 57 insertions(+), 6 deletions(-)
 delete mode 100644 .changeset/sour-comics-attend.md

diff --git a/.changeset/famous-terms-rescue.md b/.changeset/famous-terms-rescue.md
index 68fd1f3591..d323bf0867 100644
--- a/.changeset/famous-terms-rescue.md
+++ b/.changeset/famous-terms-rescue.md
@@ -13,3 +13,15 @@ backend:
     window: 6s
     incomingRequestLimit: 100
 ```
+
+Plugin specific rate limiting can be configured by adding the following configuration to `app-config.yaml`:
+
+```yaml
+backend:
+  rateLimit:
+    global: false # This will disable the global rate limiting
+    plugin:
+      catalog:
+        window: 6s
+        incomingRequestLimit: 100
+```
diff --git a/.changeset/sour-comics-attend.md b/.changeset/sour-comics-attend.md
deleted file mode 100644
index 729fc59ba7..0000000000
--- a/.changeset/sour-comics-attend.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@backstage/backend-defaults': patch
----
-
-Add configuration variable for `express` trust proxy setting
diff --git a/docs/backend-system/core-services/http-router.md b/docs/backend-system/core-services/http-router.md
index d7658d9a67..87462eac5a 100644
--- a/docs/backend-system/core-services/http-router.md
+++ b/docs/backend-system/core-services/http-router.md
@@ -68,6 +68,50 @@ For those routes you will also have to specify `allowLimitedAccess: true` when
 using the [`auth`](./auth.md) and [`httpAuth`](./http-auth.md) services to
 access the incoming credentials.
 
+## Rate limiting
+
+Rate limiting allows you to limit the amount of requests users can send to you backend.
+This is useful for blocking various network attacks, such as DDOS, if your instance does not
+have additional firewall configured to handle this.
+
+To configure the default rate limiting, add the following to your config:
+
+```yaml
+backend:
+  rateLimit: true
+```
+
+You can additionally configure the rate limiting parameters also by plugin:
+
+```yaml
+backend:
+  rateLimit:
+    global: true # Enables or disables rate limit for all plugins
+    window: 6s # Time window for rate limiting for single client
+    incomingRequestLimit: 100 # Number of requests to accept from one client during time window
+    ipAllowList: ['127.0.0.1'] # IPs to bypass rate limiting
+    skipSuccesfulRequests: false # Rate limit successful requests
+    skipFailedRequests: false # Rate limit failed requests
+    plugin:
+      # Plugin specific rate limiting
+      catalog:
+        window: 3s
+        incomingRequestLimit: 50
+```
+
+By default, the rate limiting is per instance and the request counts are stored into memory.
+If you want to share this information across all your backstage instances, you have to configure
+the rate limiting store:
+
+```yaml
+backend:
+  rateLimit:
+    global: true
+    store:
+      type: redis
+      connection: redis://127.0.0.1:16379
+```
+
 ## Configuring the service
 
 For more advanced customization, there are several APIs from the `@backstage/backend-defaults/httpRouter` package that allow you to customize the implementation of the config service. The default implementation uses all of the middleware exported from `@backstage/backend-defaults/httpRouter`, including `createLifecycleMiddleware`, `createAuthIntegrationRouter`, `createCredentialsBarrier` and `createCookieAuthRefreshMiddleware`. You can use these to create your own `httpRouter` service implementation, for example - here's how you would add a custom health check route to all plugins:
diff --git a/packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts b/packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts
index 377d7fa301..b139b212d2 100644
--- a/packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts
+++ b/packages/backend-defaults/src/entrypoints/httpRouter/http/createRateLimitMiddleware.ts
@@ -23,7 +23,7 @@ export const createRateLimitMiddleware = (options: {
   config: Config;
 }) => {
   const { pluginId, config } = options;
-  const configKey = `backend.rateLimit.${pluginId}`;
+  const configKey = `backend.rateLimit.plugin.${pluginId}`;
   const enabled = config.has(configKey);
   if (!enabled) {
     return (_req: Request, _res: Response, next: NextFunction) => {