Edge Case: API Rate Limiting and Abuse Prevention

  Property: ChurchWiseAI   Category: Security Tier: all Persona: security-tester Touchpoint: /api/chatbot/stream, /api/contact, /api/newsletter

Preconditions

• Rate limiting middleware is configured
• Tests run in serial mode (rate limits consumed per test)
• Retries: 2 to handle instance variability in serverless

Steps

#	Action	Expected Result
1	Send 35 rapid chatbot requests with fake churchId	At least one request returns 429 Too Many Requests. Rate limit enforced.
2	Send 8 rapid contact form submissions with empty data	At least one request returns 429. Contact form rate limit enforced.
3	Send 8 rapid newsletter subscribe requests	At least one request returns 429. Newsletter rate limit enforced.
4	Send 15 voice agent webhook requests (SIP invite)	At least one returns 429. Voice agent abuse protection active.
5	Wait 5 seconds after hitting rate limit	Submit another request. Returns 200 (rate limit reset). Temporary throttling works.
6	Send requests from multiple sessions (different sessionIds)	Rate limiting applies per client IP or globally, not per session. System prevents multi-session bypass.
7	Send requests spread across 60 seconds (1 per second)	All requests succeed (status 200 or 400, never 429). Legitimate slow traffic not throttled.

Known Failure Modes

• No 429 response after 35 requests — rate limiting not enforced
• Rate limit never resets — temporary IP ban too aggressive
• Multi-session bypass possible — abuse vector remains
• Legitimate slow traffic throttled — false positives

References

• Playwright spec: e2e/edge-rate-limiting.spec.ts
• Code files:
  • src/middleware/rate-limit.ts
  • src/app/api/chatbot/stream/route.ts
  • src/app/api/contact/route.ts
  • src/lib/rate-limiter.ts

Notes

Tests rate limiting across multiple endpoints. Vercel serverless spreads requests across instances, so rate limiting is probabilistic — tests use retries: 2 to handle flakiness. Tests must run in serial mode to properly consume quota. Rate limiting should trigger at ~30-35 reqs in 1 second for chatbot, ~8 for contact form. Legitimate slow traffic (1 req/sec) should never be throttled.