# NautheraRateLimitingHigh

More than 10% of public requests are refused with 429.

## Meaning

Over ten minutes, more than the threshold (10%) of public requests were answered `429`,
for fifteen minutes. The per-IP limit (`rate_limit.rps`, 50 a second, `burst` 100 with
the `memory` backend) and the brute-force throttles both answer 429. A flood from a few
addresses, a client retrying in a loop, or every request appearing to come from one
address (a proxy the server does not trust) are the usual causes.

## Impact

Callers over the limit are refused until their budget refills, with `Retry-After`. If
the cause is an untrusted proxy, legitimate users and relying parties are throttled
together and sign-ins fail broadly. If it is a flood, the limit is doing its job and
other callers are unaffected.

## Diagnosis

1. Which routes: `sum by (route) (rate(nauthera_http_requests_total\{job="<name>",
   code="429"\}[10m]))`.
2. Which callers: the `http_request` log lines with `status` 429 carry `client_ip`,
   `client_kind` and `client_agent`:
   `kubectl -n <ns> logs deploy/<name> | jq 'select(.msg=="http_request" and .status==429)
   | .client_ip' | sort | uniq -c | sort -rn | head`.
3. One address for everyone: the server logs at startup when the client address is the
   socket peer; platform administrators also see a warning on the dashboard's Overview
   when requests seem to arrive through an untrusted proxy.
4. With the `redis` backend, `nauthera_rate_limit_degraded{job="<name>"}` is 1 while a
   replica limits on its own counter.

## Mitigation

- Untrusted proxy: set `security.client_ip.mode` and list the proxy's addresses in
  `security.trusted_proxies` (see
  [the client address](https://www.nauthera.io/docs/v1/configuration#the-client-address)).
- A flood: block it at the ingress or WAF.
- A client retrying in a loop: contact its owner; the `client_agent` and the audit
  records `auth.rate_limit.triggered` help identify it.
- Legitimate traffic above the limit: raise `config.rate_limit.rps` and `burst`.

## Escalation

Informational. Escalate to the identity platform owner when legitimate users are
throttled, and to the security team when it is a flood that the edge cannot absorb.

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.