Advanced rate-limiting rules

Create a rate-limiting Advanced Rule on Custom Rules to cap how many matching requests a domain accepts in a time window. Start from a Quick Template, configure request.limit_rate in the visual builder, or write a CEL expression.

A Rate Limit rule type sets a single per-IP threshold without CEL. Use Advanced Rule to apply a template, combine conditions, or edit request.limit_rate parameters.

Advanced Rule creation

1
Custom Rules page
In the CDB Technical Web Portal, navigate to WAAP > Custom Rules. Click Add custom rule.
2
Advanced Rule type
Enter a Rule name. Under Rule type, select Advanced Rule.

Quick templates

Under Quick Templates, click Captcha Rate Limit 100 req/5s or Block Rate Limit 200 req/5s.

Captcha Rate Limit 100 req/5s sets the action to Captcha and generates:

request.limit_rate(url='.*', interval=5, requests=100, scope='ip')

Block Rate Limit 200 req/5s sets the action to Block and generates:

request.limit_rate(url='.*', interval=5, requests=200, scope='ip') || tags.exists('penalty')

tags.exists('penalty') matches requests from an IP that already carries the penalty tag. The block still applies after the request rate falls below the threshold.

Advanced Rule builder with Captcha action, limit_rate condition, and Quick Templates

Both templates count requests per IP on every URL (.*). Click Save to keep the template values, or adjust the function first.

Rate-limit configuration

In the visual builder, the condition uses object request and attribute limit_rate. Click Edit Config to change the threshold, time window, URL pattern, scope, and optional filters.

request.limit_rate configuration panel with url, interval, requests, and scope

The dialog requires a URL pattern, interval, request count (minimum 20), and scope (ip or cluster). Optional lists narrow the count to specific IPs, methods, status codes, a content type, or a tag.

Click Apply Configuration. The Expression field updates to the generated CEL. Add more And rows to combine the rate limit with other attributes. Click Save.

CEL expression

Click Edit manually to replace the visual builder with a CEL editor. The generated request.limit_rate(...) expression stays in the field and can be combined with other conditions.

Click Visual builder to return to the condition rows. Additional conditions in the same rule control when the action runs — they do not change how requests are counted. Click Save.

Rate-limiting rules use the request.limit_rate method in a CEL source expression. This is part of WAAP advanced rules.

Rate-limiting conditions are evaluated as part of a rule's condition logic and can be combined with other request attributes to control when an action is triggered.

Rate limiting method

Use the request.limit_rate method to implement rate limiting:

limit_rate fixed method signature

request.limit_rate(
    requests = <int>,
    interval = <int>,
    url = <string>,
    ip_list = [<string>, ...],
    method_list = [<string>, ...],
    status_list = [<int>, ...],
    content_type = <string>,
    scope = <string>,
    tag = <string>
)

Specify the tag parameter when configuring tag-based rate limiting rules.

The method returns true, and the enclosing rule condition is satisfied when the request count (4), under the granularity (8), exceeds the configured threshold within the specified time window (3), using the configured filters (1, 2, 5, 6, 7, 9).

#	Parameter name	Required	Description
1	`ip_list`	False	List of IP addresses that the rule applies to. If there are no IPs in the list, counting will be done for all IPs.
2	`url`	True	A regex pattern used to match the request path, excluding query parameters.
3	`interval`	True	The time window, in seconds, during which the configured number of requests is allowed.
4	`requests`	True	The maximum number of requests accepted within the given period before an action is taken (minimum value is 20 requests).
5	`method_list`	False	List of method types the request aggregation will be applied to.
6	`status_list`	False	List of status codes the request aggregation will be applied to.
7	`content_type`	False	Regex pattern to match request content_type against.
8	`scope` (granularity)	True	When protecting the origin, rate limit rules can apply to either IPs or all requests that come through the cluster. If set to `ip`, the rule is triggered when one IP exceeds the threshold — this helps against individual attackers. If set to `cluster`, the rule is triggered when the total requests from any IP in that cluster exceed the threshold — this helps protect the origin from getting too many requests.
9	`tag`	False	Limits requests with the specified user-defined tag. Requests are aggregated according to `scope`.

Implementation

An API token is required along with the ID of a WAAP-protected domain. For SDK examples, install the Python or Go SDK. Set these as environment variables before running any of the examples:

export GCORE_API_KEY="{YOUR_API_KEY}"
export WAAP_DOMAIN_ID="{YOUR_DOMAIN_ID}"

The examples create disabled rules (enabled=false). Enable a rule after review when it is ready to take effect. To list, update, enable, disable, or delete rules, see Advanced Rules.

Rate limiting with exclusions

Rate-limit IPs that exceed 200 requests in 5 seconds on any /events path, while excluding requests from known mobile and web clients that carry session cookies.

import gcore
import os

client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])

rule = client.waap.domains.advanced_rules.create(
    domain_id,
    name="Block Scrapers",
    description="Block IPs that hit more than 200 requests per 5 seconds for any events paths",
    enabled=False,
    phase="access",
    action={"block": &#123;"status_code": 403, "action_duration": "10m"&#125;},
    source=(
        "request.limit_rate(url='.*events', interval=5, requests=200, scope='ip')"
        " and not ('mb-web-ui' in request.headers['Cookie']"
        " or 'mb-mobile-ios' in request.headers['Cookie']"
        " or 'mobile-android' in request.headers['Cookie']"
        " or 'mb-mobile-android' in request.headers['Cookie']"
        " or 'session-token' in request.headers['Cookie'])"
        " and not request.headers['session']"
    ),
)
print(f"Created rule ID: {rule.id}")

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/waap"
)

func main() {
    client := gcore.NewClient()
    domainID, err := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)
    if err != nil {
        panic(fmt.Errorf("invalid WAAP_DOMAIN_ID: %w", err))
    }

    source := "request.limit_rate(url='.*events', interval=5, requests=200, scope='ip')" +
        " and not ('mb-web-ui' in request.headers['Cookie']" +
        " or 'mb-mobile-ios' in request.headers['Cookie']" +
        " or 'mobile-android' in request.headers['Cookie']" +
        " or 'mb-mobile-android' in request.headers['Cookie']" +
        " or 'session-token' in request.headers['Cookie'])" +
        " and not request.headers['session']"

    rule, err := client.Waap.Domains.AdvancedRules.New(
        context.Background(),
        domainID,
        waap.DomainAdvancedRuleNewParams{
            Name:        "Block Scrapers",
            Description: gcore.String("Block IPs that hit more than 200 requests per 5 seconds for any events paths"),
            Enabled:     false,
            Phase:       waap.DomainAdvancedRuleNewParamsPhaseAccess,
            Action: waap.DomainAdvancedRuleNewParamsAction{
                Block: waap.DomainAdvancedRuleNewParamsActionBlock{
                    StatusCode:     403,
                    ActionDuration: gcore.String("10m"),
                },
            },
            Source: source,
        },
    )
    if err != nil {
        panic(err)
    }
    fmt.Printf("Created rule ID: %d\n", rule.ID)
}

curl -X POST "https://api.cdb-staging.cdn.orange.com/waap/v1/domains/${WAAP_DOMAIN_ID}/advanced-rules" \
  -H "Authorization: APIKey ${GCORE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Block Scrapers",
    "description": "Block IPs that hit more than 200 requests per 5 seconds for any events paths",
    "enabled": false,
    "phase": "access",
    "action": {"block": &#123;"status_code": 403, "action_duration": "10m"&#125;},
    "source": "request.limit_rate(url='\''.*events'\'', interval=5, requests=200, scope='\''ip'\'') and not ('\''mb-web-ui'\'' in request.headers['\''Cookie'\''] or '\''mb-mobile-ios'\'' in request.headers['\''Cookie'\''] or '\''mobile-android'\'' in request.headers['\''Cookie'\''] or '\''mb-mobile-android'\'' in request.headers['\''Cookie'\''] or '\''session-token'\'' in request.headers['\''Cookie'\'']) and not request.headers['\''session'\'']"
  }'

The API returns the created rule with its assigned ID:

{
  "id": 269012,
  "name": "Block Scrapers",
  "enabled": false,
  "action": {"block": &#123;"status_code": 403, "action_duration": "10m"&#125;},
  "source": "request.limit_rate(url='.*events', interval=5, requests=200, scope='ip') ...",
  "phase": "access"
}

Rate-limiting examples

The following examples show common request.limit_rate patterns. Each example creates a disabled rule. Enable it after review. Adapt paths, IPs, and cookies to the environment.

Per-IP rate limit for any URL

Each request is counted individually per IP. When the rule is enabled, if 203.0.113.10 sends more than 200 requests within 5 seconds, it is blocked. Another IP, 203.0.113.11, is only blocked when it independently exceeds the same threshold.

import gcore
import os

client = gcore.CDB()
domain_id = int(os.environ["WAAP_DOMAIN_ID"])

rule = client.waap.domains.advanced_rules.create(
    domain_id,
    name="Limit Certain IPs",
    description="Limit Certain IPs",
    enabled=False,
    phase="access",
    action={"block": &#123;"status_code": 403&#125;},
    source="request.limit_rate(url='.*', interval=5, requests=200, scope='ip')",
)
print(f"Created rule ID: {rule.id}")

package main

import (
    "context"
    "fmt"
    "os"
    "strconv"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/waap"
)

func main() {
    client := gcore.NewClient()
    domainID, err := strconv.ParseInt(os.Getenv("WAAP_DOMAIN_ID"), 10, 64)
    if err != nil {
        panic(fmt.Errorf("invalid WAAP_DOMAIN_ID: %w", err))
    }

    rule, err := client.Waap.Domains.AdvancedRules.New(
        context.Background(),
        domainID,
        waap.DomainAdvancedRuleNewParams{
            Name:        "Limit Certain IPs",
            Description: gcore.String("Limit Certain IPs"),
            Enabled:     false,
            Phase:       waap.DomainAdvancedRuleNewParamsPhaseAccess,
            Action:      waap.DomainAdvancedRuleNewParamsAction{Block: waap.DomainAdvancedRuleNewParamsActionBlock{StatusCode: 403}},
            Source:      "request.limit_rate(url='.*', interval=5, requests=200, scope='ip')",
        },
    )
    if err != nil {
        panic(err)
    }
    fmt.Printf("Created rule ID: %d\n", rule.ID)
}

curl -X POST "https://api.cdb-staging.cdn.orange.com/waap/v1/domains/${WAAP_DOMAIN_ID}/advanced-rules" \
  -H "Authorization: APIKey ${GCORE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Limit Certain IPs",
    "description": "Limit Certain IPs",
    "enabled": false,
    "phase": "access",
    "action": {"block": &#123;"status_code": 403&#125;},
    "source": "request.limit_rate(url='\''.*'\'', interval=5, requests=200, scope='\''ip'\'')"
  }'