Skip to content

Add explanation to 403 Forbidden, when it is due to failed authentication rate limit 1 hour block

A lot of issues and tickets are due to confusing 403 Forbidden responses for an hour. E.g. https://gitlab.com/gitlab-com/support-forum/issues/3274#note_81524158

If the 403 Forbidden response said "Too many failed authentication attempts", this would reduce the volume of issues and tickets, as well as allow sysadmins/devs/support to quickly and easily know what the problem is.

Proposal

Return the static message Too many failed authentication attempts from this IP when authentication rate limit causes failure. See #22787 (comment 1290862091)

Edited by Hannah Sutor