> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-15.md).

# Throttling is not enabled in SCM

## Rule Details

|                       |                      |
| --------------------- | -------------------- |
| Cortex AppSec Rule ID | APPSEC\_CICD\_15     |
| Category              | System Configuration |
| Severity              | LOW                  |

## Impact

Throttling is a technique used to limit the number of requests done by a user in a certain period. GitLab offers an inherent throttling mechanism in its self-managed instances to limit the number of requests sent to its API. However this setting is not applied on the instance. An attacker with access to GitLab can abuse its API to find sensitive files, to check the accessibility of administrative pages, or to overload the instance resources.

## Recommended Solution - Buildtime

GitLab self-managed instances offer three options to limit requests:

* Unauthenticated requests
* Authenticated API requests
* Authenticated web requests

There are two options for setting limits:

### Modify settings through the console:

1. In the **Admin Area**, access **Settings**.
2. Under **Network** scroll to **User and IP Rate Limits**.
3. Configure the three settings (see above) with the organization’s required limits.

   For more information refer to <https://docs.gitlab.com/ee/user/admin\\_area/settings/user\\_and\\_ip\\_rate\\_limits.html#user-and-ip-rate-limits>.

### Modify settings through the API:

1. Follow the instructions on the GitLab API documentation: documentation: <https://docs.gitlab.com/ee/api/settings.html#change-application-settings>
2. Set the **throttle\_** settings according to environment requirements.

{% hint style="info" %}

* Bypassing throttling settings: If required, add a custom header to requests via predefined services to bypass throttling settings. Refer to: <https://docs.gitlab.com/ee/user/admin\\_area/settings/user\\_and\\_ip\\_rate\\_limits.html#use-an-http-header-to-bypass-rate-limiting>
* Allow specific users to bypass the rate limiter. Refer to: <https://docs.gitlab.com/ee/user/admin\\_area/settings/user\\_and\\_ip\\_rate\\_limits.html#allow-specific-users-to-bypass-authenticated-request-rate-limiting>
* GitLab allows setting a throttle to *dry run mode* which logs a message to the auth.log when it hits the limit, while letting the request continue as normal. Refer to: <https://docs.gitlab.com/ee/user/admin\\_area/settings/user\\_and\\_ip\\_rate\\_limits.html#try-out-throttling-settings-before-enforcing-them>
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/ci-cd-security/system-configurations/appsec-cicd-15.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.