From 5ac1b486a733f412fb647b9d2a58071df17f1d89 Mon Sep 17 00:00:00 2001
From: MichaelDvP <github@mdvp.de>
Date: Sat, 11 Jul 2026 15:27:59 +0200
Subject: [PATCH] block too much GET requests with semaphore

---
 src/web/WebAPIService.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/web/WebAPIService.cpp b/src/web/WebAPIService.cpp
index e9373e3c4..f9a4f654b 100644
--- a/src/web/WebAPIService.cpp
+++ b/src/web/WebAPIService.cpp
@@ -39,6 +39,12 @@ WebAPIService::WebAPIService(AsyncWebServer * server, SecurityManager * security
 // POST|GET api/{device}
 // POST|GET api/{device}/{entity}
 void WebAPIService::webAPIService(AsyncWebServerRequest * request, JsonVariant json) {
+    static bool busy = false;
+    if (busy && request->method() == HTTP_GET) {
+        request->send(429); // too many requests
+        return;
+    }
+    busy = true;
     JsonDocument input_doc; // has no body JSON so create dummy as empty input object
     JsonObject   input;
     // if no body then treat it as a secure GET
@@ -53,6 +59,7 @@ void WebAPIService::webAPIService(AsyncWebServerRequest * request, JsonVariant j
         input["data"] = json.as<std::string>();
     }
     parse(request, input);
+    busy = false;
 }
 
 // for POSTS accepting plain text data