starter.wiki

Security

Rate Limiting

Choose request quota enforcement by policy key, window, algorithm, state, enforcement location, failure behavior, and ownership.

Recommendation

Place the quota where identity and traffic are known reliably.

Use an application or edge route for focused web workloads, a gateway policy for governed APIs, and Envoy only where a service platform can operate distributed enforcement.12

For: Application, API, edge, and platform teams protecting capacity or enforcing product and tenant quotas

Main trade-off

Rate limiting protects capacity and fairness while adding policy design, distributed state, latency, consistency, failure-mode, retry, observability, bypass, and cost responsibilities.1234

Choose the control and ownership model

Start from the threat, protected asset, evidence obligation, or enforcement point before comparing products.

  1. Policy identity

    Define IP, user, account, API key, route, method, resource, tenant, subscription, or workload keys and resistance to spoofing.13

  2. Quota semantics

    Set limits, windows, bursts, concurrency, cost weights, fairness, hierarchy, overrides, response status, retry guidance, and resets.12

  3. Distributed state

    Choose local, regional, global, eventually consistent, or centralized counters and define races, clock behavior, partitions, and recovery.14

  4. Enforcement and failure

    Place enforcement, prevent bypass, choose fail-open or fail-closed behavior, expose telemetry, and test policy changes safely.12

Decision routes

Each route addresses a bounded security job and retains an explicit verification and failure boundary.

A TypeScript application or edge function owns the policy key

Evaluate Upstash Ratelimit.

Upstash Ratelimit is the application and edge TypeScript route when code-level policy and a managed Redis-backed state model fit.

Verify: Verify algorithms, identifiers, regions, latency, analytics, ephemeral cache, fail behavior, Redis usage, privacy, and bypass paths.1

Traffic already enters through Cloudflare and should be limited at the edge

Evaluate Cloudflare Rate Limiting.

Cloudflare Rate Limiting is the product-specific edge route when request characteristics and Cloudflare's enforcement model can express the quota.

Verify: Verify rule characteristics, counting, actions, duration, availability by plan, limits, analytics, origin bypass, identity quality, and current pricing.2

API quotas belong in an existing Kong gateway control plane

Evaluate Kong Gateway.

Kong is the API-gateway route when route, service, consumer, credential, or gateway policy already provides the enforcement context.

Verify: The team owns gateway topology, policy scope, data store, synchronization, availability, plugins, upgrades, latency, metrics, and licensing.3

A service platform already operates Envoy and a rate-limit service

Use Envoy deliberately.

Envoy is the self-operated service-proxy route when local or global rate enforcement belongs in an existing proxy and control-plane architecture.

Verify: The team owns descriptor design, rate-limit service, distributed state, availability, configuration delivery, observability, overload, failure, and upgrades.4

Boundary: Rate Limiting controls activity volume in a policy window; Bot Protection evaluates automated behavior, WAF filters HTTP requests, and Authorization decides whether an action is permitted.

Differences that change the control

Compare enforcement, evidence, operating ownership, failure behavior, sensitive-data exposure, and exit rather than marketing breadth.

Enforcement point
Application, edge, gateway, and service-proxy placement determines available identity, bypass risk, latency, and ownership.34
State model
Managed Redis, edge counters, gateway stores, and an external rate-limit service have different consistency and failure behavior.1
Policy model
Product entitlements, abuse limits, API consumer quotas, and service protection require different keys and overrides.3
Operations
Rules, metrics, tuning, cost, outages, retries, support, configuration rollout, and incident response remain ongoing work.1

Official resources

Verify current control boundaries, telemetry or evidence handling, deployment, limits, pricing, policy, and operating responsibilities in first-party material.

Sources

Official documentation supports product boundaries and verification points; the route recommendation remains a bounded editorial judgment.

  1. 1
    Upstash Ratelimit overview

    Upstash · Accessed Official

  2. 2
    Cloudflare rate limiting rules

    Cloudflare · Accessed Official

  3. 3
    Kong rate limiting plugin

    Kong · Accessed Official

  4. 4
    Envoy rate limit documentation

    Envoy · Accessed Official

  5. 5
    RFC 6585: 429 Too Many Requests

    IETF · Accessed Official