Skip to content

ratelimits/wfe: Implement per-endpoint per-IP address rate limits #8668

@beautifulentropy

Description

@beautifulentropy

Overrides should be on a per-account basis. If we follow the example of CertificatesPerDomainPerAccount, which does something similar, capacity MUST be consumed from each RequestsPerPerAccount bucket and SHOULD be consumed from each RequestsPerPerIP bucket, if possible.

  • Setup two enums for each endpoint we wish to rate limit in ratelimits/names.go
    • RequestsPerPerIP for regular requesters
    • RequestsPerPerAccount for requesters with per-account overrides
  • Update the string representation of the Name in nameToString
  • Update the validators for that name in validateIdForName() (you should use validIPAddress() and validIPv6RangeCIDR())
  • Update the transaction constructors for that name in transaction.go
  • Update the Subscriber facing error message in Decision.Result()
  • Update the case in BuildBucketKey() for that name

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions