Rate Limiting

AuthProxy uses a shared fixed-window rate limiter for HTTP requests plus a separate bandwidth limiter for file transfer throughput.

HTTP Rate Limiter Model

All HTTP scopes use the same window:

• RateLimitWindowSeconds defines the shared window size. Default: 5.
• Each scope stores an RPS setting.
• Effective quota for one window is rps * RateLimitWindowSeconds.
• When the quota is exceeded, AuthProxy returns 429 Too Many Requests with ApiGateError.AccessRateLimit (1002).

This model allows short frontend bursts without keeping a separate token-bucket implementation for sessions.

HTTP Scopes

Scope	Key	Default RPS	Default window quota	Setting
Connection	HttpContext.Connection.Id	2	10 / 5s	ApiRPSLimit = 7
IP	client IPv4	12	60 / 5s	IpRPSLimit = 23
Public key	pkey header	2	10 / 5s	PubKeyApiRPSLimit = 10
Session	session.sid	3	15 / 5s	SessionApiRPSLimit = 11
MCP login	X-PublicKey	2	10 / 5s	McpApiRPSLimit = 16

Scope Application

• Requests without session are checked by connection, then ip.
• Routes with CheckPubKey add the pkey scope on top of connection and ip.
• Requests with session use the session scope.
• POST /auth/v1/mcp_login additionally uses the mcp scope.
• Routes marked with RouteFlags.NoRateLimit skip the HTTP limiter entirely.
• Static files served directly from FileCacheMiddleware are not affected by this HTTP limiter.

Response Headers

Successful and rejected requests can include:

X-RateLimit: s=s;l=15;r=9;t=4

Header fields:

• s = active scope code: c connection, i ip, p pkey, s session, m mcp
• l = full window quota
• r = remaining requests in the current window
• t = seconds until window reset

Rejected responses also include:

HTTP/1.1 429 Too Many Requests
X-RateLimit: s=m;l=10;r=0;t=3
Retry-After: 3

Retry-After is the authoritative value clients should use for retry timing.

Bandwidth Limiting

Bandwidth limiting is independent from the HTTP fixed-window limiter:

• Keyed by a configurable string
• Quota is measured in bytes per second
• Used by file upload and download streaming
• Refills every second

This limiter is meant for large file flows where request-count limiting would hurt UX.

Configuration

Rate limits are configurable via the settings table or admin panel.

Admin Panel

Navigate to /ProxyAdmin/Settings to view and adjust rate limit parameters.

Settings Table

Rate limits are stored in the settings table with flags field as the numeric value:

Setting Type	ID	Description	Default
ApiRPSLimit	7	Per-connection RPS	2
PubKeyApiRPSLimit	10	Per public key RPS	2
SessionApiRPSLimit	11	Per-session RPS	3
McpApiRPSLimit	16	MCP login RPS	2
IpRPSLimit	23	Per-IP RPS	12
RateLimitWindowSeconds	25	Shared fixed-window interval	5

Monitoring

Monitor rate limiting through:

• /proxyadmin/monitoring rate limit stats
• application logs and 429 metrics
• client-side tracking of X-RateLimit and Retry-After

Best Practices

• Frontend GET retry: use Retry-After for automatic retry of safe idempotent calls.
• Session-heavy UIs: keep SessionApiRPSLimit conservative, increase RateLimitWindowSeconds for burst tolerance instead of inventing custom buffers.
• NAT-heavy traffic: tune IpRPSLimit higher than the connection limit to avoid punishing many users behind one public IP.
• Load testing: temporarily raise RPS settings or mark bench-only routes with NoRateLimit.