EN Rate Limits and Protection

Rate limits, request protection and proxy trust

English · Türkçe · Languages / Diller

Scope: JSON API Forge 0.5.1 · Source review: 17 September 2026 · Language: English

Forge applies token-bucket budgets to pre-authentication IP traffic, principals and optionally individual routes. Memory limits are worker-local; Redis provides shared atomic budgets. A separate 120-request limit per worker is not a single 120-request budget for the cluster.

Layer	What it limits
Pre-auth	Client-IP traffic before identity resolution
Principal	Overall budget for an authenticated caller
Route	A narrower budget for a normalized route identity
Concurrency	Simultaneous work
Body/result bounds	Memory and data volume
Timeout/queue wait	Waiting time

rate_limit.fail_open defaults to false. Do not automatically reuse a cache fail-open preference for rate limiting. Rehearse availability and protection behavior during a Redis outage in staging.

Reverse-proxy configuration

protection.trusted_proxy_cidrs allows forwarded client-IP/protocol values only when the direct peer is trusted. trusted_hosts identifies expected hosts. security.require_https, allowed_ips and denied_ips define application access boundaries.

{
  "protection": {
    "trusted_proxy_cidrs": ["127.0.0.1/32"],
    "trusted_hosts": ["api.example.com"],
    "max_request_body_bytes": 1048576,
    "max_concurrent_requests": 100,
    "request_timeout_seconds": 15,
    "reject_when_saturated": true
  },
  "security": {"require_https": true}
}

This example is appropriate only if the actual proxy connects from loopback. Select CIDRs for your topology; do not trust the entire Internet as a proxy. Configure Editor EDITOR_TRUSTED_* policies separately.

CORS

CORS controls browser behavior, not API-key or row authorization. Project settings include cors_origins, cors_methods, cors_headers, cors_expose_headers, cors_allow_credentials and preflight cache lifetime. An origin contains scheme and authority, without a path/query. Allow only the origins and headers you need.

Size, waiting and capacity

The ASGI body limiter counts received chunks rather than trusting only Content-Length. Typical outcomes include 413 for size limits, 429 for rate budgets and 503 for saturation/dependency problems. Reverse-proxy upload and timeout limits also apply; the tighter applicable boundary determines the result.

Limiting WebSocket handshakes does not automatically limit messages on an established connection. Configure realtime accordingly. All fields/defaults are in the security and protection models.

Sources and verification

This page describes the behavior at the pinned commits below. Recheck these contracts when upgrading.

• main/framework/rate_limit.py
• main/framework/protection.py
• main/framework/config.py
• main/docs/31-Reverse-Proxy-Trust-TLS-and-Client-IP.md

---

English home · All English pages · Version maintenance