onetimesecret/onetimesecret · error · Onetime::LimitExceeded

Too many password reset requests. Please try again later.

Error message

Too many password reset requests. Please try again later.

What it means

Error "Too many password reset requests. Please try again later." thrown in onetimesecret/onetimesecret.

Source

Thrown at lib/onetime/security/reset_request_rate_limiter.rb:290

      end

      private

      # Atomically check-and-record one tier via CHECK_AND_RECORD_SCRIPT.
      # Raises LimitExceeded when the tier is locked; otherwise logs as the
      # count approaches/reaches the cap (the detection tie-in for #3872 —
      # alert on these alongside the reset_password_request_no_account events).
      # The cap-hit also writes one ColonelAuditEvent, so the signal is queryable
      # and not only greppable — see record_reset_request_throttle_audit.
      def enforce_reset_request_tier!(keys, max_attempts, tier_label, subject)
        allowed, detail = reset_request_redis.eval(
          CHECK_AND_RECORD_SCRIPT,
          keys: [keys[:attempts], keys[:lockout]],
          argv: [reset_request_window, max_attempts, reset_request_lockout],
        )

        if allowed.to_i != 1
          raise Onetime::LimitExceeded.new(
            'Too many password reset requests. Please try again later.',
            retry_after: detail.to_i.positive? ? detail.to_i : reset_request_lockout,
            max_attempts: max_attempts,
          )
        end

        count = detail.to_i
        if count >= max_attempts
          # This cap-reaching request was itself ALLOWED (the Lua script locks
          # after incrementing); the lockout applies to subsequent requests.
          obscured = obscured_reset_request_subject(tier_label, subject)
          OT.le "[ResetRequestRateLimiter] #{tier_label} #{obscured} " \
                "hit cap (#{count}/#{max_attempts}); locked for #{reset_request_lockout}s" \
                "#{collapsed_ip_tier_hint(tier_label)}"
          record_reset_request_throttle_audit(tier_label, obscured, count, max_attempts)
        elsif count >= max_attempts - 1
          OT.li "[ResetRequestRateLimiter] #{tier_label} #{obscured_reset_request_subject(tier_label, subject)} at #{count}/#{max_attempts} requests"
        end

View on GitHub (pinned to f81295e41b)

Solutions

1. Wait for the rate-limit window to pass; check the mailbox (including spam) for the earlier reset email before requesting another.

When it happens

Trigger: Thrown at lib/onetime/security/reset_request_rate_limiter.rb:290 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of onetimesecret/onetimesecret@f81295e41b (2026-08-23). Data as JSON: /api/errors/c9d99d01fea0e05f. Report an issue: GitHub.