Question about GitHub's rate limit

[SuspiciousLookingOwl]

Hi,

First I want to say this is an awesome app that you built, thank you for making this!

I'm planning to use this on my project and I want to ask you regarding GitHub's rate limit. GitHub's GraphQL API have a rate limit of 5000 points / hour (up to 5000 request / hour) for authorized request (with Authorization header), how do you deal with this rate limit? Haven't check how GitHub bot works, does the bot have no rate limit?

Thanks in advance!

[laymonage]

Hey, thank you for the kind words!

That's a good question. For now, I haven't handled the rate limit at all, but it's on my radar.

Yes, the 5000 points/hour limit also applies to the bot. However, giscus only authenticates as the bot for the following operations:

• Fetching repository information (repositoryId and categoryIds)
• Fetching discussions anonymously (not signed in)
• Posting new discussions (if no matching discussion exists)

For all other operations (posting comments, reactions, etc.) giscus authenticates as the user, so the 5000 points/hour limit is imposed on the user. In this case, I think the 5000 points/hour limit is generous. Going beyond that limit is highly unlikely, but possible (e.g. if the user also uses GitHub's API by other means).

The bot hitting the 5000 points/hour is more likely, especially if we have a lot of users (or maybe a few but with high traffic). At the very least, I think we should handle this case. A possible solution is to show an error message indicating the rate limit and a hint to sign in. Though at this point I think it wouldn't be much effort to also handle the case where the user already hits the rate limit.

For reference, utterances only sends a warning to the console when it hits the rate limit. It's also much easier to detect it on the REST API since you can just check the header. With the GraphQL API, you need to explicitly include rateLimit in the query.

I've created an issue for this, see #87.

Thanks!

[laymonage]

@SuspiciousLookingOwl

There's a guide for self-hosting giscus now, which may be useful if you don't want the rate limit to be affected by other sites that use giscus.