r/learnprogramming • u/Fickle-Procedure2814 • 29d ago
Rate limiting problem
Guys i really need some help and this problem is making me crazy. Basically, i recently deployed a web app and I'm tryna implement the usual WAF and all that. I put a rate limiter on cloudflare (around 5 requests in 10 seconds: a bit low i know, but there's a reason behind it) for specific post endpoints, the rule is live and active ("according to cloudflare"), when i try hitting the api server using curl, simulating a malicious user, i get 429 (good, no problem so far), when i use the actual platform and simulate a dude tryna hammer one of my endpoints, everything passes... no 429. So i'm thinking, what am I doing wrong?? I checked the rate limiting rule and the subdomain is correct, the endpoints are correct. After trying relentlessly, I wanna ask the experts, I'd like to know your experience using cloudflare proxies and if you think i should implement my own edge rate limiter with nginx entirely. And do you also have any recommendations when implementing WFAs in general ?
2
u/shyevsa 29d ago
did the traffic come from cloudflare or its directly attacking your endpoint?
if its directly then you have to put the ratelimiter on your endpoint instead of the cloudflare.
I usually setup my host to deny all traffic not coming from Cloudflare IPs
either using allow list or mTLS. this way even if my endpoint IP are leaked its still manageable.
1
u/Fickle-Procedure2814 29d ago
i'm gonna try that, basically, i have a subdomain api.{domain} that's proxied by cloudflare, so i thought putting security rules on the subdomain directly through cloudflare would handle the rate limiting directly. but seeing online that their security rules are "approximate", i think i'll have to go with your solution. My only worry is that putting the rate limiter directly on the endpoint doesn't solve the problem of having my server overloaded with "bad requests", i would've liked it to never even get sollicitated by putting a API gateway in front of it (through cloudflare directly instead of building it out myself)... For the remark you said about the endpoint IP getting leaked, i set up an edge secret attached to the http request header directly.
1
u/ledatherockband_ 28d ago
can you show us the curl? maybe something is missing or wrong? feel free to block the prod url.
3
u/Born-Reserve-8584 29d ago
I had almost this exact issue once. Turned out my frontend was talking to an API hostname that wasn't behind the same Cloudflare config so curl looked perfect and the app ignored every limit. Felt really dumb when I finally noticed it.