From bfda4eacce7f68bb705eb0ff3ece8f2fc0ff1792 Mon Sep 17 00:00:00 2001
From: James Smith <james@floppy.org.uk>
Date: Wed, 26 Nov 2025 15:55:31 +0000
Subject: [PATCH] rate limit all doorkeeper controllers

using the same limit as user sessions
---
 app/controllers/doorkeeper_base_controller.rb | 3 +++
 config/initializers/doorkeeper.rb             | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 app/controllers/doorkeeper_base_controller.rb

diff --git a/app/controllers/doorkeeper_base_controller.rb b/app/controllers/doorkeeper_base_controller.rb
new file mode 100644
index 000000000..5857e09e6
--- /dev/null
+++ b/app/controllers/doorkeeper_base_controller.rb
@@ -0,0 +1,3 @@
+class DoorkeeperBaseController < ActionController::Base # rubocop:disable Rails/ApplicationController
+  rate_limit to: 10, within: 3.minutes
+end
diff --git a/config/initializers/doorkeeper.rb b/config/initializers/doorkeeper.rb
index c5d66d056..d6cf4bf91 100644
--- a/config/initializers/doorkeeper.rb
+++ b/config/initializers/doorkeeper.rb
@@ -2,7 +2,7 @@
 
 Doorkeeper.configure do
   orm :active_record
-  base_controller "ActionController::Base"
+  base_controller "DoorkeeperBaseController"
 
   # Enabled grant flows
   grant_flows %w[client_credentials]