Introducing Advanced Rate Limiting
Mar 16, 2022Daniele Molteni
Summary
Introduced Advanced Rate Limiting, a new capability integrated with the WAF and Firewall Rules. This feature allows for defining rate limiting rules based on a wide range of HTTP request characteristics (URI, method, headers, cookies, body fields, bot score, JA3 fingerprint) and counting requests based on various dimensions (IP, country, header, cookie, ASN, query parameter value, bot fingerprint). It also enables separating the mitigation expression from the counting expression, allowing for more flexible blocking actions. The post details use cases for protecting web traffic and APIs, including counting based on session ID, request body content, and future support for complexity-based rate limiting.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack