Limits at the Edge and Gateway — Rate Limiting, Quotas & Abuse Protection

Enforce coarse limits as early as possible: CDN/WAF rules (Cloudflare, AWS WAF, Akamai) stop floods before they reach your infrastructure; API gateways (Kong, Envoy, AWS API Gateway, Apigee) enforce per-key plans and quotas. Edge limits know little about your domain, so keep business-aware limits (per account action, per resource) in the application.

Enforcement layers

Layer	Sees	Good for	Not good for
CDN / WAF	IP, path, headers, bot score	Floods, scraping, L7 DDoS	Per-account business rules
API gateway	API key, route, plan	Plans, quotas, per-key limits	Domain-specific rules
Service / app	User, tenant, resource, action	Business limits (OTP per phone)	Absorbing floods
Database / queue	Load	Last-resort protection	Fairness

# AWS WAF rate-based rule (concept): block IPs > 2000 req / 5 min on /api/auth/*
{
  "Name": "auth-rate-limit",
  "Priority": 1,
  "Action": { "Block": { "CustomResponse": { "ResponseCode": 429 } } },
  "Statement": { "RateBasedStatement": { "Limit": 2000, "AggregateKeyType": "IP",
    "ScopeDownStatement": { "ByteMatchStatement": { "FieldToMatch": { "UriPath": {} }, "SearchString": "/api/auth/",
      "PositionalConstraint": "STARTS_WITH", "TextTransformations": [{ "Priority": 0, "Type": "NONE" }] } } } },
  "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "authRateLimit" }
}

Common pitfalls

Relying only on edge limits for business rules.
Origins reachable directly, bypassing edge limits.
Edge limits keyed on IP for authenticated APIs.

Key points

Coarse limits at the edge
Plans at the gateway
Business limits in the app

Further reading: Cloudflare: Rate limiting rules

Practice questions

Why keep some rate limits in the application even with a gateway?

Answer

Business-specific limits (e.g., 3 OTPs per phone number per hour, 10 exports per tenant per day) require domain context the gateway doesn't have.

What's the risk of an origin reachable without going through the CDN?

Answer

Attackers can bypass edge rate limits and WAF rules entirely by hitting the origin directly.