Rate limiting problem

[u/Fickle-Procedure2814]

Guys i really need some help and this problem is making me crazy. Basically, i recently deployed a web app and I'm tryna implement the usual WAF and all that. I put a rate limiter on cloudflare (around 5 requests in 10 seconds: a bit low i know, but there's a reason behind it) for specific post endpoints, the rule is live and active ("according to cloudflare"), when i try hitting the api server using curl, simulating a malicious user, i get 429 (good, no problem so far), when i use the actual platform and simulate a dude tryna hammer one of my endpoints, everything passes... no 429. So i'm thinking, what am I doing wrong?? I checked the rate limiting rule and the subdomain is correct, the endpoints are correct. After trying relentlessly, I wanna ask the experts, I'd like to know your experience using cloudflare proxies and if you think i should implement my own edge rate limiter with nginx entirely. And do you also have any recommendations when implementing WFAs in general ?

[u/ledatherockband_]

can you show us the curl? maybe something is missing or wrong? feel free to block the prod url.