Limit Request Concurrency
Limit request concurrency caps the number of simultaneous requests in a key space you choose: concurrency above the shape threshold is shaped, and above the reject threshold requests are rejected.
Configure the action
- Open the target HTTP application’s Page Rules.
- Create or edit a rule and add Limit request concurrency.
- Add one or more Key components, such as client IP address, URI, Cookie, or a request header.
- Set Shape at and Reject at.
- Select a Reject Action and fill in its required fields.
- Save, release the application, and test with controlled concurrent traffic.
Shape at defaults to 1 and Reject at to 10. Both take non-negative integers, and Reject at cannot be lower than Shape at.
Choose keys that represent the resource you actually need to protect. Before
trusting an X-Forwarded-For value, make sure only trusted proxies can supply it
and that they overwrite whatever the client sent.
Limit by Matched Network
The Client privacy provider and Client matched network (CIDR) keys were
first introduced in OpenResty Edge 26.12.1-1. After upgrading the Admin and
gateways to 26.12.1-1 or later, select Client matched network (CIDR)
in the key dropdown to group requests by the main IP database’s matched network.
Addresses in the same network share an allowance. Adding Client IP Address
as another key component separates the addresses again.
Client privacy provider groups requests by service name. Matching records
without a name share the empty-string group. Before grouping by network, use a
non-empty client-network condition so the rule applies only to requests with
a matched network. A /32 or /128 still represents one address, and database
updates can change the grouping.
See IP Geolocation Database for field semantics and upgrade requirements.
Reject actions
The action can return an error or a page template, require CAPTCHA, hCaptcha, JavaScript Challenge, Redirect Validate, or Private Access Token, and use the other reject actions that the current Edge Admin form offers.
Private Access Token additionally needs a fallback and a Clearance Time,
which defaults to 60 seconds.
A Page Template fallback requires a template; custom Edge CAPTCHA and hCaptcha
templates must contain ::CAPTCHA_BOX:: and ::HCAPTCHA_BOX:: respectively;
JavaScript Challenge uses no template.
For PAT issuer, permission, fallback, and release behavior, see Private Access Tokens.
Observation options
Set Reject Action to Log Only and enter a Log Name to record over-limit requests without rejecting them. At most one entry is written per second. Log Delayed Requests controls whether requests in the throttling range are logged and is enabled by default. Turning it off does not remove the delay.
Both parameters were first introduced in OpenResty Edge 26.12.1-1.