diff --git a/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php b/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php
index 4c16c565d6236..c0086e10d69de 100644
--- a/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php
+++ b/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php
@@ -105,6 +105,7 @@ public function __construct($appName,
 	 * @NoCSRFRequired
 	 * @PublicPage
 	 * @BruteForceProtection(action=receiveFederatedShare)
+	 * @AnonRateLimit(limit=5, period=1200)
 	 *
 	 * @param string $shareWith
 	 * @param string $name resource name (e.g. document.odt)
diff --git a/apps/federatedfilesharing/lib/Controller/RequestHandlerController.php b/apps/federatedfilesharing/lib/Controller/RequestHandlerController.php
index bb40a92e816ae..52ca5c10df174 100644
--- a/apps/federatedfilesharing/lib/Controller/RequestHandlerController.php
+++ b/apps/federatedfilesharing/lib/Controller/RequestHandlerController.php
@@ -120,6 +120,7 @@ public function __construct(string $appName,
 	/**
 	 * @NoCSRFRequired
 	 * @PublicPage
+	 * @AnonRateLimit(limit=5, period=1200)]
 	 *
 	 * create a new share
 	 *