A rate limit that looks fine in the dashboard can count the wrong thing, in one location only, or on the wrong key. WAF rule, Workers binding, 429.
A rate limit is meant to say "no more than this much, from this caller, in this time". On Cloudflare you can build one in three places: a WAF rate limiting rule at the edge, the Workers Rate Limiting binding inside your code, or a counter you write yourself. Each one can be configured so that it exists, passes review and still does not limit the thing you had in mind. The usual causes are a plan that does not offer the option you wanted, a counter that only sees one location, and a key that many unrelated callers share. The sections below take these causes one by one and end with the reply a limited client should receive.
Read the full report on AISkills402: https://aiskills402.com/blog/cloudflare-rate-limiting-design?utm_source=devto&utm_medium=social
Top comments (0)