{"record":{"id":"cbfb88a23568dcc0","repo":"overleaf/overleaf","slug":"too-many-requests-cbfb88","errorCode":null,"errorMessage":"Too Many Requests","messagePattern":"Too Many Requests","errorType":"http","errorClass":null,"httpStatus":429,"severity":"error","filePath":"services/web/app/src/Features/User/UserEmailsController.mjs","lineNumber":212,"sourceCode":"    if (!sessionData) {\n      logger.err({}, `error checking confirmation code. missing ${sessionKey}`)\n\n      return res.status(422).json({\n        message: {\n          key: 'error_performing_request',\n        },\n      })\n    }\n\n    const emailToCheck = sessionData.email\n\n    try {\n      await checkConfirmCodeRateLimiter.consume(emailToCheck, 1, {\n        method: 'email',\n      })\n    } catch (err) {\n      if (err?.remainingPoints === 0) {\n        return res.sendStatus(429)\n      } else {\n        return res.status(500).json({\n          message: {\n            key: 'error_performing_request',\n          },\n        })\n      }\n    }\n\n    if (sessionData.confirmCodeExpiresTimestamp < Date.now()) {\n      return res.status(403).json({\n        message: { key: 'expired_confirmation_code' },\n      })\n    }\n\n    if (!tsscmp(sessionData.confirmCode, code)) {\n      return res.status(403).json({\n        message: { key: 'invalid_confirmation_code' },","sourceCodeStart":194,"sourceCodeEnd":230,"githubUrl":"https://github.com/overleaf/overleaf/blob/28ad3b03b71cb4311decdcb55c36b33ec10d72db/services/web/app/src/Features/User/UserEmailsController.mjs#L194-L230","documentation":"Sent by _checkConfirmationCode when checkConfirmCodeRateLimiter.consume rejects with remainingPoints === 0. This is a sentinel-field guard on the limiter error: too many confirmation-code checks have been attempted for the pending email address, so further attempts are refused with 429 to prevent brute-forcing codes.","triggerScenarios":"Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:212 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Wait for the rate limit window to expire before retrying the code","Request a fresh confirmation email rather than guessing codes","Review the confirmation-code limiter settings if the limit is too strict","Contact support if locked out and the code is known to be correct"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"28ad3b03b71cb4311decdcb55c36b33ec10d72db","analyzedAt":"2026-09-03T02:10:22.807Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T07:17:11.731Z"}