Fixed
Rate limiting is scoped per application again
The per-application rate limit was keyed on the visitor address alone, so a load test against one application consumed the budget of every application behind the same edge node.
View as Markdown- The limit is now keyed on address and hostname together
- An exhausted limit answers 429 with a retry hint and the correct cross-origin headers instead of an opaque 503
- The mapping from zone name to key is frozen by a test, because a zone cannot be re-keyed without a rename
AffectsApplications