overleaf/overleaf · error

Too Many Requests

Error message

Too Many Requests

What it means

Sent by _checkConfirmationCode when checkConfirmCodeRateLimiter.consume rejects with remainingPoints === 0. This is a sentinel-field guard on the limiter error: too many confirmation-code checks have been attempted for the pending email address, so further attempts are refused with 429 to prevent brute-forcing codes.

Source

Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:212

    if (!sessionData) {
      logger.err({}, `error checking confirmation code. missing ${sessionKey}`)

      return res.status(422).json({
        message: {
          key: 'error_performing_request',
        },
      })
    }

    const emailToCheck = sessionData.email

    try {
      await checkConfirmCodeRateLimiter.consume(emailToCheck, 1, {
        method: 'email',
      })
    } catch (err) {
      if (err?.remainingPoints === 0) {
        return res.sendStatus(429)
      } else {
        return res.status(500).json({
          message: {
            key: 'error_performing_request',
          },
        })
      }
    }

    if (sessionData.confirmCodeExpiresTimestamp < Date.now()) {
      return res.status(403).json({
        message: { key: 'expired_confirmation_code' },
      })
    }

    if (!tsscmp(sessionData.confirmCode, code)) {
      return res.status(403).json({
        message: { key: 'invalid_confirmation_code' },

View on GitHub (pinned to 28ad3b03b7)

Solutions

1. Wait for the rate limit window to expire before retrying the code
2. Request a fresh confirmation email rather than guessing codes
3. Review the confirmation-code limiter settings if the limit is too strict
4. Contact support if locked out and the code is known to be correct

When it happens

Trigger: Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:212 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• HTTP status errors: handling 4xx and 5xx responses — how to handle 4xx and 5xx responses properly.

AI-assisted analysis of overleaf/overleaf@28ad3b03b7 (2026-09-03). Data as JSON: /api/errors/cbfb88a23568dcc0. Report an issue: GitHub.