Skip to main content

Rate Limiting Settings

HTTP Gateway supports rate limiting rules configured per route. A rule applies only to requests whose domain and path match that route. When the same upstream resource is configured on multiple routes, each route can use a different rate limit threshold.

Configure Rate Limiting​

  1. Log in to the CloudBase Console and select the target environment.
  2. Go to HTTP Gateway in the left navigation.
  3. Under Route Management, find the route to configure and click Rate Limiting Settings.
  4. Under rate limiting settings, configure route-dimension and client-dimension rate limiting as needed.
  5. Save the configuration.

Rate Limiting Rules​

Route-Dimension Rate Limiting​

Route-dimension rate limiting uses the current route path as its scope and limits the total number of requests that match that path, preventing the route from being over-invoked and becoming unavailable.

Configuration Instructions​

  • Configurable range: 100 to the environment's maximum QPS.
  • Calculation method: Requests per second (QPS) = Total requests matching the current route path / second.
  • Typical scenarios:
    • Protect critical APIs from being overwhelmed by sudden traffic surges.
    • Restrict the frequency of third-party calls.
    • Control upstream resource usage costs.

Configuration Recommendations​

  1. Set a reasonable threshold based on peak business traffic.
  2. Reserve 20%-30% buffer space to accommodate traffic fluctuations.
  3. Use monitoring alerts to promptly detect rate limiting situations.

Example: A route has an average QPS of 80 and a peak of 120. It is recommended to configure rate limiting at 150 QPS.

Client-Dimension Rate Limiting​

Client-dimension rate limiting restricts the request frequency of a single client to the current route, preventing malicious API scraping or excessive resource usage by users.

Configuration Instructions​

  • Configurable range: 0 to 30 QPS.
  • Identification method:
    • UserID (CloudBase user ID/WeChat openid): Rate limits by user ID.
    • ClientIP (client IP address): Rate limits by the IP address of the client making the request.
  • Selection recommendations:
    • Use UserID for applications with a user identity system.
    • Use ClientIP for anonymous access scenarios.
    • Only one identification method can be selected for the same route.
  • Typical scenarios:
    • Prevent users from frequently refreshing a page.
    • Restrict crawler activity.
    • Control API call quotas.
    • Protect sensitive APIs from brute-force attacks.

Notes:

  • The UserID method requires requests to include user identity information. Requests without a user ID are ignored and allowed to pass.
  • ClientIP may inadvertently block legitimate users sharing the same IP address.
  • Configure both route-dimension and client-dimension rate limiting for critical services to protect upstream resources from traffic surges and prevent a single client from calling an API excessively.