Rate limit a web app

1 Why rate limiting matters

Rate limiting caps how many requests reach the web server in a given period, protecting server resources, keeping the service available, improving the experience and defending against abuse:

• Protects resources: prevents overload and exhaustion of CPU, memory and bandwidth;
• Keeps quality: stable, fast responses under high concurrency;
• Defends against attacks: mitigates DDoS-style floods built from huge request volumes;
• Fairness: stops a single user or program from consuming most resources;
• Cost control: avoids surprise bills on usage-based cloud services;
• Better experience: no slowdowns or outages during traffic peaks.

2 Configure the site limit

The limit lives in servers_limit under the http node:

{
  "http": {
    "include": "mime.types",
    "servers_limit": {
      "limit": 1000000,
      "burst": 5000000,
      "max_body_size": 1048576,
      "max_header_size": 4096
    },
    "server": [
      {
        "listen": 7000,
        "server_name": "localhost",
        "location": [
          {
            "url": "/api1",
            "type": "rewrite",
            "rewrite": "http://xxxx.com"
          }
        ]
      }
    ]
  }
}

servers_limit enables site rate limiting:

3 When the limit trips

When an IP exceeds limit or sends more requests than burst, that IP is added to the blocklist and denied access.

4 Related reading

• Blocklist format and troubleshooting: Block IP addresses