Missing X-RateLimit Header when GET /releases with token?

[alex3236]

Select Topic Area

Bug

Body

WITH token:
X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset are missing.

$ curl -I "https://api.github.com/repos/kubernetes/kubernetes/releases" --header "Authorization: ***"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0 81841    0     0    0     0      0      0 --:--:--  0:00:01 --:--:--     0HTTP/1.1 200 OK
Date: Sun, 29 Sep 2024 03:25:01 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 81841
Cache-Control: private, max-age=60, s-maxage=60
Vary: Accept, Authorization, Cookie, X-GitHub-OTP,Accept-Encoding, Accept, X-Requested-With
ETag: "bacc58eb3466cf9113f62d949995795f6c395befdeb5424feed14fa6c6b81c37"
X-OAuth-Scopes: repo
X-Accepted-OAuth-Scopes: repo
X-GitHub-Media-Type: github.v3; format=json
Link: <https://api.github.com/repositories/20580498/releases?page=2>; rel="next", <https://api.github.com/repositories/20580498/releases?page=24>; rel="last"
x-github-api-version-selected: 2022-11-28
Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Content-Security-Policy: default-src 'none'
Server: github.com
X-GitHub-Request-Id: 1BE1:2C220D:19BF347:1B01377:66F8C88C

WITHOUT token:

$ curl -I "https://api.github.com/repos/kubernetes/kubernetes/releases"
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/1.1 200 OK
Date: Sun, 29 Sep 2024 03:25:10 GMT
Content-Type: application/json; charset=utf-8
Cache-Control: public, max-age=60, s-maxage=60
Vary: Accept,Accept-Encoding, Accept, X-Requested-With
ETag: W/"57fa7b25666a66b321aabcb74b6d37ba7ba73254ed19ad76553fcb00acea8ff4"
X-GitHub-Media-Type: github.v3; format=json
Link: <https://api.github.com/repositories/20580498/releases?page=2>; rel="next", <https://api.github.com/repositories/20580498/releases?page=24>; rel="last"
x-github-api-version-selected: 2022-11-28
Access-Control-Expose-Headers: ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset
Access-Control-Allow-Origin: *
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: origin-when-cross-origin, strict-origin-when-cross-origin
Content-Security-Policy: default-src 'none'
Server: github.com
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59
X-RateLimit-Reset: 1727583909
X-RateLimit-Resource: core
X-RateLimit-Used: 1
Accept-Ranges: bytes
X-GitHub-Request-Id: 1BE2:E269E:EE49EE:FA6BE0:66F8C895

[Rana718]

When using a personal access token with the GitHub API (GET /releases endpoint), the X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, and X-RateLimit-Reset headers may be missing.

---

Possible Reasons:

1. OAuth Scopes: Ensure that the token you are using has the appropriate OAuth scopes (e.g., repo). Sometimes, limited scopes can prevent certain headers from appearing in the response.

2. Rate Limit Differences: GitHub applies different rate limits for authenticated and unauthenticated requests. Without a token, the default limit is lower (60 requests per hour for unauthenticated users). Authenticated requests have a higher rate limit, which may cause the X-RateLimit headers to behave differently.

3. Header Exposure: Depending on the type of request (authenticated vs unauthenticated), the API might expose fewer headers. You can check the headers being exposed via the Access-Control-Expose-Headers field in the response.

4. Potential Bug: If the headers are missing despite using the correct scopes and authentication, it could be a bug or an intentional design change by GitHub. It's worth checking the GitHub API documentation or reporting the issue on GitHub's support channels.

Hope this helps clarify why the headers may be missing in your case!

[alex3236]

A GPT generated answer? I'm sure my token has enough permissions. Until yesterday it works fine. The missing items are listed in Access-Control-Expose-Headers and the documentation.

thx though

[wpbonelli]

I'm also noticing this, but have not found any announcement of a change in the API response