ShieldGate Docs

Traffic control

Rate limiting

Fixed, sliding, and token-bucket limits with route or global bindings.

Goal

Protect upstreams from abuse with rate-limit policies.

Prerequisites

  • Permission ratelimits.read / ratelimits.write.
  • Redis enabled for multi-node enforcement (local store works for single Proxy).

Steps

  1. Open Security → Rate limits.
  2. Create a policy: algorithm, permit count, window/burst, queue limit.
  3. Bind to exactly one of: global, a route, or a proxy host.
  4. Save (auto-publish).

Algorithms

Algorithm Behavior
Fixed window Counters reset each window
Sliding window Smoother limiting across window edges
Token bucket Burst-friendly sustained rate

Runtime behavior

  • Middleware returns 429 with Retry-After when denied.
  • Redis keys look like sg:t:{tenantId}:rl:{policyId}:{scopeKey}.
  • Redis errors fail open so an outage does not blackhole traffic.
  • Policies can also trigger RateLimit actions from the WAF engine.

Verify

  • Generate traffic above the limit; expect 429.
  • Confirm other clients/scopes are unaffected.