I set up a Cloudflare rate limit for specific POST endpoints at about five requests per ten seconds. Curl tests get a 429, but repeated requests through the app seem to pass. The rule is active and the configured subdomain and paths look right.
What should I check next? Would an Nginx rate limiter be a better option?
Compare the actual app request with the curl request, not just the rule settings. In the browser network panel, check the request URL, method and path, then compare them with curl. Also check which response you are looking at if the page makes several requests.
A correct API subdomain in the rule won't help if the app is sending its requests to a different hostname or path. Sharing a sanitized curl command and the relevant request details would make the mismatch easier to spot.
Check whether the requests that pass are actually going through Cloudflare. A proxied API hostname can be covered by its rules, but traffic sent directly to the origin can bypass them.
If the origin should only be reachable through Cloudflare, consider restricting origin access to Cloudflare IP ranges or using authenticated connections such as mTLS. Make sure you account for any legitimate direct access before locking it down.
I wouldn't replace the WAF yet. First verify that both tests match the same rule and reach the same service. Rate limiting can be approximate, so a small number of requests getting through does not necessarily mean the rule is inactive.
If you need a stricter limit, an origin-side limiter in Nginx or the application can provide another layer. Test how it identifies clients when requests come through a proxy, so you don't accidentally apply one shared limit to everyone.
Answers are reviewed before publication.
Related Discussions