Free tools Windows power users keep installed
One-click scans. No signup required.
You can protect an API at the edge without caching a single response. Caching decides whether a stored response can be reused; edge enforcement decides whether a request should be forwarded, challenged, throttled, or rejected. The hard part is designing controls that match real client identity and request cost without fragmenting rate limits across too many counting contexts—or assuming distributed counters behave like one exact global quota.
How can an edge defend an API that does not cache responses?
An edge service can inspect and control a request before forwarding it, even when the response must be generated dynamically by the origin. That lets an API use the edge for authentication checks, request validation, rate limiting, challenges, or blocking while continuing to send each accepted request to the application.
As an Amazon Associate I earn from qualifying purchases.
AWS documents one such configuration: a customer-managed CloudFront distribution in front of a Regional API Gateway, forwarding all headers so the content is treated as dynamic and caching is skipped. Its guidance also calls for origin protection, method-level rate limits, and authentication. This is an AWS-specific pattern, not a universal configuration. The broader distinction is simple: response reuse is optional; request admission is a separate control.
Recommended Free Tools
What is a “cardinality bomb” in rate limiting?
Every rate-limit rule needs a definition of which requests share a counter. If a rule counts by IP, requests from the same IP may share a bucket. If it counts by API key and path, each distinct key-and-path combination may have its own counting context. A “cardinality bomb” is the risk that highly variable values—such as resource IDs in paths, user identifiers, or combinations of attributes—create a very large number of distinct contexts.
#1 Best Overall
That is a design risk, not a documented universal memory limit or cost threshold. The consequences depend on how a particular provider creates, distributes, retains, and synchronizes counters. For example, Cloudflare documents that characteristic combinations define counter contexts and that each rate-limiting rule is data-center-scoped, rather than sharing one globally synchronized counter across its entire network. Do not assume the same model—or a globally exact quota—from another provider without checking its current documentation.
Which identity should a rate limit count?
Choose the characteristic that matches the policy’s purpose and is stable enough to resist easy evasion. No single identity works for every endpoint. An IP address can help with anonymous abuse, but shared networks can combine unrelated users and distributed clients can spread requests across many addresses. A customer credential can align a quota with an account, but only if the credential is validated and not freely rotated by an attacker.
| Counting characteristic | Useful for | Trade-off to check |
|---|---|---|
| IP address or network | Basic controls for anonymous traffic. | Shared addresses can group legitimate users; distributed clients can dilute per-address limits. |
| Validated API key or authenticated subject | Customer- or account-level fairness and quotas. | Validate the credential first; an API key alone is not a substitute for authentication. |
| Session identifier | Grouping activity that belongs to one application session, including requests from changing IP addresses. | Use a meaningful, trusted session value. Cloudflare API Shield supports configured session identifiers, including selected authorization-header or JWT-claim values, subject to feature prerequisites. |
| Path or operation | Separate budgets for different resources or kinds of work. | Dynamic identifiers can create many distinct contexts. Cloudflare documents combining a path with an API key to limit a client per file; verify the counter behavior for the chosen implementation. |
| Combination of characteristics | More specific policies, such as a per-client limit on a particular resource. | Each added dimension can split traffic into more contexts. Cloudflare documents that the same API-key value paired with different IPs is counted separately when the combination differs. |
Prefer a validated, stable identity—such as an authenticated subject claim—when the platform can reliably extract and verify it. Avoid basing a security boundary on a raw client-supplied value that the caller can change at will.
Rank #2
How should limits be layered?
One request-count threshold cannot serve every purpose. A useful design applies different controls at scopes that correspond to the work being protected:
- Operation scope: protect sensitive or costly routes, such as login, password reset, exports, expensive searches, and writes.
- Client scope: keep one customer or authenticated subject from consuming a disproportionate share of capacity.
- Broader service scope: cap traffic by method, account, or another supported aggregate to reduce the chance that total admitted load overwhelms the origin.
- Request-admission scope: authenticate and validate requests before they trigger expensive application or downstream work.
AWS API Gateway documents account-level throttling, per-method throttling, and per-client usage-plan limits, with API keys used for usage-plan scopes. Its throttling uses a token bucket and returns HTTP 429 when configured limits are exceeded. AWS describes API keys as an additional layer rather than the sole authentication mechanism. A limit should be calibrated against the service’s traffic history and capacity: the cited guidance does not establish a universal safe request rate.
How can limits account for workload, not just request count?
Request counts treat a cheap read and a costly export as equivalent unless the policy distinguishes them. That mismatch is especially visible in GraphQL: one route can carry operations with very different complexity. Cloudflare’s API guidance identifies three useful control points: limit calls to a particular operation by user, cap a user’s aggregate query complexity over time, and cap the complexity of an individual query.
Rank #3
Cloudflare also documents complexity-based rate limiting that uses a numeric score supplied by the origin in a response header. The feature is tied to Enterprise Advanced Rate Limiting and requires application instrumentation to produce the score. Its documentation says a missing or out-of-range score does not update the corresponding counter, so the operator needs an explicit policy for that failure case rather than assuming the request was charged normally.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Cost-aware limits can better reflect expensive work, but they add implementation and operational requirements. Define where scores come from, their valid range, what happens when they are missing, and how those values map to an acceptable workload. Where that work is not justified, operation-specific request limits remain a simpler baseline.
How should an API validate requests before forwarding them?
Rate limiting controls volume; it does not establish that a request has a valid shape or is authorized to perform the requested operation. Pair it with authentication and request validation where the API and edge platform support them.
Rank #4
- API Security in Action
- Manning Publications
- ABIS BOOK
- Inventory operations and methods. Separate public endpoints from authenticated ones, and identify routes that trigger expensive computation or downstream services.
- Establish expected request shapes. Cloudflare API Shield describes discovering API operations, learning a schema from traffic, or uploading an OpenAPI schema.
- Check what “detection” actually does. Cloudflare documents that schema detection can be always-on after a profile is available, but mitigation requires a separate WAF custom rule. A learned schema should not be mistaken for automatic blocking.
- Verify feature prerequisites. Cloudflare’s API-specific recommendations require API Shield access, a configured session identifier that matches operation traffic, sufficient data, and completed processing.
Where the platform offers observation or log mode, use it to inspect which identities and operations a proposed rule matches before enforcing broadly. Stage blocking carefully, especially for rules based on learned traffic or uncertain identity extraction, and measure false positives against legitimate use.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do you stop callers from bypassing the edge?
An edge rule cannot protect an origin that remains directly reachable through another hostname, endpoint, or network path. Map the public and internal routes that can reach the API, then ensure intended traffic is forced through the enforcement point.
AWS documents adding a custom origin header or API key at CloudFront to reduce direct access to API Gateway, and also mentions request signing with Lambda@Edge and IAM authorization as an approach. Its endpoint-protection guidance recommends authentication and authorization; it warns that unauthenticated API endpoints are more vulnerable to application-layer DDoS attacks because requests do not require valid credentials.
Best Value
For the actual deployment, check origin firewall or network policy, alternate endpoints and custom-domain routing, how the edge proves its identity to the origin, and how any shared secret is stored and rotated. The AWS pattern is documented guidance for that platform, not a universal origin-lockdown recipe.
What should you verify before deploying a rate-limit policy?
Compare enforcement systems on their behavior for your workload, not on a vendor’s generic “global” or “real-time” label. Get answers for the selected service, plan, and configuration:
- Counter scope: Is each counter local to an edge location, shared across a region, or synchronized more broadly?
- Distribution behavior: How quickly do counters propagate, and how much burst overshoot can occur when traffic reaches multiple locations?
- Key behavior: Which values are trusted and stable, which are client-controlled, and how many distinct contexts can the rule create?
- Workload model: Does enforcement count requests, distinguish operations, or support an origin-supplied cost score?
- Action and recovery: Can the rule log, challenge, block, or throttle? What response does the client receive, and for how long does mitigation apply?
- Validation behavior: Does schema discovery merely detect deviations, or does it block them? Is a separate rule or feature required?
- Origin resistance: Can callers bypass the edge, and how is edge-to-origin traffic authenticated?
- Operational prerequisites: Does the feature require a particular plan, session setup, observed traffic volume, or telemetry?
- Cost and latency: Measure these for the selected service and workload; vendor-specific outcomes cannot be inferred from rate-limit design alone.
For client handling, document what to do when throttled. AWS API Gateway returns 429 for configured throttling and recommends that clients use increasing backoff when repeated errors occur. That behavior is preferable to immediately retrying at the same rate and adding load to a constrained service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
A practical rollout sequence
- Map the work. List methods, routes, GraphQL operations, authentication requirements, expensive dependencies, and acceptable bursts. Set initial budgets using your own traffic and capacity data, not a copied threshold.
- Select the identity per policy. Use IP/network characteristics for appropriate anonymous controls, validated client identities for account fairness, and resource or operation characteristics only when their additional counter partitioning is intentional.
- Layer controls. Add operation-specific limits for costly work, client-level fairness limits, and a broader cap that protects origin capacity. Validate and authenticate before expensive processing.
- Confirm counter semantics. Test how the chosen provider scopes and distributes counters, including behavior across edge locations and with high-variance paths or combined keys.
- Observe matches before broad enforcement. Review affected clients and operations in log or observe mode where available, then stage challenges, throttles, or blocks.
- Close bypass paths. Verify that direct origin routes are restricted and that edge-to-origin credentials or signing are configured and maintained.
- Monitor and adjust. Track throttles, false positives, origin load, and client retry behavior. Revisit limits as traffic mix, capacity, or request costs change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
