Hello all,
I have been working in my Development env. just to see if I could get rate limiting to actually block a user. The flow is an API flow using Oauth tokens, and simply the request is to rate limit on the AZN_CRED_PRINCIPAL_NAME on a junction with the name /servicestatus-dev.
I have set the capacity = 2, with an interval of 30 seconds, and never see the HTTP 429 (reaction set = TEMPLATE) which should return the rate limit template page.
I am curious if the format of the YAML file might be the issue and will provide that below. From the ratelimit debug log, it looks like a bucket is started per request and ends per request, yet the same user/token is being provided and all through the same session.
I'm just at a loss, because all I'd like to see is this actually function per what documentation I have seen. Can anyone provide any insight? it would be greatly appreciated.
Sample of current YAML file for Rate Limiting:
---
#=========================
# Rate limiting AZN_CRED_PRINCIPAL_NAME
#=========================
# This policy limits the number of times a given credential can be used to
# send requests the reverse proxy in <interval> seconds from the first request.
# Once the rate limiting policy has been finalized it can be attached to a
# Web Reverse proxy instance via the reverse proxy configuration file.
# To enable this policy add the following entry to the [rate-limiting] stanza:
# policy = Limit_AZN_CRED_PRINCIPLE_NAME_Policy.yaml
#
#
#
#=========================
# Matching criteria
#=========================
# Identifies that this configuration should be applied to the
# request by method and URL. Wild cards accepted. Method, can be a comma
# separated list too. This can just as easily be applied to a form provided
# by an EAI, just update the URL to match the form action.
#
# Any request matches this criteria - request URL - HTTP method
# Examples GET, POST
resources:
- url: "/servicestatus-dev*"
method:
- "*"
# Limiting is based on the credential being used
credential:
AZN_CRED_PRINCIPAL_NAME: "*"
# Credential can be used <interval> times during the <capacity> window in seconds
capacity: 2
interval: 30
#=========================
## Tokenizing Criteria
##=========================
## Requests are built into tokens to identify them, these
## tokens consist of any permutation of IP, headers, cookies, query string
## parameters.
## Include the IP of the client
# ip: true
#=========================
## Reaction
##=========================
## How the client is notified they have been rate limited. This can
## be one of:
## 'TEMPLATE' - return a 429 and the rate limit template page
## 'CLOSE' - drop the connection.
##
## A URL to re-write the request to, for example '/dummylogin' which does not
## log the user in ever, so they're not actually aware they've been rate
## limited.
##
## In this instance we return the template, if no reaction is included this is
## the default
## Return the template if a client is rate-limited
reaction: TEMPLATE
...
------------------------------
Bayless Rutherford
------------------------------