Rate Limiting

Rate Limiting rules control how many requests a client or IP address can send to your application within a specific time window.

This helps protect against abuse, such as brute-force attempts, credential stuffing, or denial-of-service attacks, by automatically throttling or blocking traffic that exceeds the configured threshold.

Rate Limiting helps ensure fair usage, reduce the load on your application, and enhance overall security.

You can configure multiple Rate Limiting rules within a service. Each rule is defined by:

• A condition that determines which requests the rule applies to.
• A request limit for matching traffic.
• An action to take when the limit is reached, along with the duration of that action.

Example #

Limit each IP address to 100 requests per minute to the /login endpoint.

If a client exceeds this threshold, block further requests from that IP address for 10 minutes.

Adding a Rate Limiting Rule #

To add a Rate Limiting rule to your service:

1. Navigate to your service.
2. In the sidebar, select Security, then select Rate Limiting.
3. Click the Create button.
4. Complete the new Rate Limiting rule form:

• Rule Name – Enter a name for the new rule.
• Condition – Define the condition that determines which requests the rule applies to. You can create complex conditions using OR and AND operators.
• Counter – Enter the maximum number of requests allowed during the specified time window.
• Action – Select the action to take when requests reach the limit and specify the duration of that action.

5. Click Save.

Updating & Deleting a Rate Limiting Rule #

To modify or delete a Rate Limiting rule in your service:

1. Navigate to your service.
2. In the sidebar, select Security, then select Rate Limiting.
3. Find the rule you want to update or delete.
4. Click the Edit icon to modify the rule, or the Delete icon to remove it.