One-way sync (iCal) synchronization might not work when rate limiting is enabled in Confluence
Platform Notice: Data Center Only - This article only applies to Atlassian products on the Data Center platform.
Note that this KB was created for the Data Center version of the product. Data Center KBs for non-Data-Center-specific features may also work for Server versions of the product, however they have not been tested. Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.
*Except Fisheye and Crucible
Summary
When Confluence rate-limiting is enabled it could limit the requests coming from Team Calendar synchronization which might cause not having the meetings/events in third-party calendars since the synchronization requests might be rejected as well.
Environment
Confluence server and Data Center version 7.13.5
Diagnosis
In the application logs:
1
2
3
4
WARN [http-nio-8090-exec-4] [ratelimiting.internal.filter.RateLimitFilter] lambda$userHasBeenRateLimited$0 User [rate_limiting_anonymous_user] has been rate limited
-- url: /rest/calendar-services/1.0/calendar/export/subcalendar/private/calendar.ics | traceId: 355081bc9cce042a | userName: anonymous
WARN [http-nio-8090-exec-11] [ratelimiting.internal.filter.RateLimitFilter] lambda$userHasBeenRateLimited$0 User [rate_limiting_anonymous_user] has been rate limited
-- url: /rest/calendar-services/1.0/calendar/export/subcalendar/private/calendar.ics | traceId: 4c68b59b0314d2f6 | userName: anonymousWhen ICAL URL is tested on a browser Confluence returns below:
Cause
When a third-party calendar is subscribed to Confluence Team Calendar, it sends synchronization requests to Confluence by using an anonymous user. If the Rate Limiting feature is enabled it rejects the request coming from the third-party calendar and might cause not having the meetings in third-party calendars.
Solution
Adding exemptions
Exemptions are, well, special limits for users who really need to make more requests than others. Any exemptions you choose will take precedence over global settings.
After adding or editing an exemption, you’ll see the changes right away, but it takes up to 1 minute to apply the new settings to a user.
To add an exemption:
Go to the Exemptions tab.
Click Add exemption.
Find the Anonymous user and choose their new settings.
The options available here are just the same as in global settings: Allow unlimited requests, or Assign a custom limit.
Save your changes.
If you want to edit an exemption later, just click Edit next to a user’s name in the Exemptions tab.
Allow listing URLs and resources
For Rate Limiting there is a way to allow whole URLs and resources on your Confluence instance using a system property. This should be used as a quick fix for something that gets rate limited but shouldn’t.
To allow specific URLs to be excluded from rate limiting:
Stop Confluence.
Add the
com.atlassian.ratelimiting.whitelisted-url-patternssystem property, and set the value to a comma-separated list of URLs, for example:1CATALINA_OPTS="-Dcom.atlassian.ratelimiting.whitelisted-url-patterns=/**/rest/applinks/**,/**/rest/capabilities,/**/rest/calendar-services/** ${CATALINA_OPTS}"The way you add system properties depends on how you run Confluence. See Configuring System Properties for more information.
Restart Confluence.
Disabling Rate Limiting
If the rate limit is controlled by an intermediate layer like reverse proxy, load balancer, or firewall, you may also disable the rate-limiting feature by following the below steps:
Navigate to
> General Configuration > Rate Limiting,
Select Disabled,
Then Save your changes.
The page should look like the below:
Was this helpful?