Cloudflare Developers•2mo ago

Rate Limit not limitting

I have a simple worker that reads an API Key from D1 and shall use the rate limitter to apply limits to it. I've configured a very small limit in my config to test it:

[[unsafe.bindings]]
name = "RPC_LIMITER"
type = "ratelimit"
namespace_id = "1"
simple = { limit = 1, period = 60 }

[[unsafe.bindings]]
name = "RPC_LIMITER"
type = "ratelimit"
namespace_id = "1"
simple = { limit = 1, period = 60 }

and I wanted to test the limit, it was not applied. Even calling it with a hard coded key does not limit it in my tests:

            const limit = await env.RPC_LIMITER.limit({ key: "apiKey.userId" })
            const { success } = limit
            if (!success) {
                return new Response(`429 Failure – rate limit exceeded for ${apiKey.userId}`, { status: 429 })
            }

            const limit = await env.RPC_LIMITER.limit({ key: "apiKey.userId" })
            const { success } = limit
            if (!success) {
                return new Response(`429 Failure – rate limit exceeded for ${apiKey.userId}`, { status: 429 })
            }

Am I missing something? It seems like the limitter is not incrementing. Thanks a lot, in advance, for any help!

1 Reply

favo•2mo ago

When is eventually? Should it not apply after a few seconds? With the above example, I set it to 1 request per minute. Running with a delay of a few seconds (5 or 30) is what I expected to be incremented at least. reduced to the smallest testable version:

export default {
    async fetch(request, env): Promise<Response> {
        const { success } = await env.RPC_LIMITER.limit({ key: "test" })
        if (!success) {
            return new Response(`429 Failure – rate limit exceeded`, { status: 429 })
        }

        return new Response('success')
    }
}

export default {
    async fetch(request, env): Promise<Response> {
        const { success } = await env.RPC_LIMITER.limit({ key: "test" })
        if (!success) {
            return new Response(`429 Failure – rate limit exceeded`, { status: 429 })
        }

        return new Response('success')
    }
}

(wrangler 3.63.2) calling:

curl https://WORKER && sleep 10 && curl https://WORKER

curl https://WORKER && sleep 10 && curl https://WORKER

will always return success – even if the second call after 10 second is above the rate limit of 1 request per minute. 10 seconds to sync the storage is something I expect. Am I doing something wrong or is there an issue with the limitter? if "eventually consistent" is outside of the configurable period and I can not limit someone to 1req within a 60s timeframe, whats the purpose of it at all? I very much would love to use the new service instead of relying on my own implementation. Is there someone who can help?

Gaming

Programming

Rate Limit not limitting