NautheraRateLimitingHigh

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

More than 10% of public requests are refused with 429.

#Meaning

Over ten minutes, more than the threshold (10%) of public requests were answered 429, for fifteen minutes. The per-IP limit (rate_limit.rps, 50 a second, burst 100 with the memory backend) and the brute-force throttles both answer 429. A flood from a few addresses, a client retrying in a loop, or every request appearing to come from one address (a proxy the server does not trust) are the usual causes.

#Impact

Callers over the limit are refused until their budget refills, with Retry-After. If the cause is an untrusted proxy, legitimate users and relying parties are throttled together and sign-ins fail broadly. If it is a flood, the limit is doing its job and other callers are unaffected.

#Diagnosis

1. Which routes: sum by (route) (rate(nauthera_http_requests_total\{job="<name>", code="429"\}[10m])).
2. Which callers: the http_request log lines with status 429 carry client_ip, client_kind and client_agent: kubectl -n <ns> logs deploy/<name> | jq 'select(.msg=="http_request" and .status==429) | .client_ip' | sort | uniq -c | sort -rn | head.
3. One address for everyone: the server logs at startup when the client address is the socket peer; platform administrators also see a warning on the dashboard's Overview when requests seem to arrive through an untrusted proxy.
4. With the redis backend, nauthera_rate_limit_degraded{job="<name>"} is 1 while a replica limits on its own counter.

#Mitigation

• Untrusted proxy: set security.client_ip.mode and list the proxy's addresses in security.trusted_proxies (see the client address).
• A flood: block it at the ingress or WAF.
• A client retrying in a loop: contact its owner; the client_agent and the audit records auth.rate_limit.triggered help identify it.
• Legitimate traffic above the limit: raise config.rate_limit.rps and burst.

#Escalation

Informational. Escalate to the identity platform owner when legitimate users are throttled, and to the security team when it is a flood that the edge cannot absorb.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.