Skip to content
Fixed

Rate limiting is scoped per application again

The per-application rate limit was keyed on the visitor address alone, so a load test against one application consumed the budget of every application behind the same edge node.

View as Markdown
  • The limit is now keyed on address and hostname together
  • An exhausted limit answers 429 with a retry hint and the correct cross-origin headers instead of an opaque 503
  • The mapping from zone name to key is frozen by a test, because a zone cannot be re-keyed without a rename
AffectsApplications