Maniphest T417778

rest gateway: enforce rate limits (stage one)
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	daniel
	Feb 18 2026, 1:32 PM

Tags

Referenced Files

None

Subscribers

Clement_Goubert

Description

Switch the first set of limits from "shadow mode" to enforced. The first set only affects unauthenticated traffic and authenticated browsers. It does not affect unauthenticated bots that provide good contact info.

See https://docs.google.com/document/d/16xtMOQoXIij5VshrXDf5N8FmFMEZwI5BfhD6mmAYvYU/edit?tab=t.xde0kat4p4xc#heading=h.27go735udow8

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Revert: rest-gateway: enable Mar2026 policy	operations/deployment-charts	master	+1 -1
	rest-gateway: enable Mar2026 policy	operations/deployment-charts	master	+1 -1

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Open		None	T399291 Epic: API Rate Limiting Architecture
		Open		None	T412585 Epic: Enforce API rate limits (WE5.1.3c)
		Open		None	T417779 rest gateway: enforce rate limits (stage two)
		Resolved		daniel	T417778 rest gateway: enforce rate limits (stage one)
		Resolved		daniel	T417780 rest gateway: include x-wmf-* headers in response
		Resolved		daniel	T417781 haproxy: strip x-wmf-* headers from responses
		Resolved		Vgutierrez	T417825 CDN: include x-is-browser in all requests to the backend
		Resolved		JAllemandou	T417864 haproxy: capture x-wmf-* headers in webrequest data set
		Resolved		DAlangi_WMF	T415007 Login with `action=login` and bot password does not create a JWT session cookie
		Resolved		• Tgr	T418999 Remove trailing slash in issuer for bot password JWT cookies
		Resolved		JAllemandou	T418455 haproxy: capture `x_trusted_request` in webrequest data set
		Duplicate		None	T418458 MW/API + haproxy: capture `x-wmf-auth-type` in webrequest data set
		Resolved		daniel	T410273 api rate limiting: Assign ratelimit class based on IP range

Event Timeline

daniel created this task.Feb 18 2026, 1:32 PM

daniel created subtask T417779: rest gateway: enforce rate limits (stage two).Feb 18 2026, 1:34 PM

daniel removed a subtask: T417779: rest gateway: enforce rate limits (stage two).

daniel edited parent tasks, added: T417779: rest gateway: enforce rate limits (stage two); removed: T412585: Epic: Enforce API rate limits (WE5.1.3c).

daniel created subtask T417780: rest gateway: include x-wmf-* headers in response.Feb 18 2026, 1:38 PM

daniel removed a project: FY2025-26 KR 5.1.Feb 18 2026, 1:42 PM

daniel created subtask T417825: CDN: include x-is-browser in all requests to the backend.Feb 18 2026, 7:57 PM

Moving to MWI Radar, as MWP & SRE should be responsible for this.

daniel created subtask T417864: haproxy: capture x-wmf-* headers in webrequest data set.Feb 19 2026, 9:37 AM

daniel changed the status of subtask T417780: rest gateway: include x-wmf-* headers in response from Open to In Progress.Feb 19 2026, 9:49 AM

daniel added a subtask: T415007: Login with `action=login` and bot password does not create a JWT session cookie.Feb 21 2026, 9:41 AM

JAllemandou created subtask T418455: haproxy: capture `x_trusted_request` in webrequest data set.Feb 26 2026, 10:20 AM

JAllemandou created subtask T418458: MW/API + haproxy: capture `x-wmf-auth-type` in webrequest data set.Feb 26 2026, 10:25 AM

daniel added a subtask: T410273: api rate limiting: Assign ratelimit class based on IP range.Feb 26 2026, 12:39 PM

Vgutierrez closed subtask T417825: CDN: include x-is-browser in all requests to the backend as Resolved.Mar 2 2026, 1:59 PM

daniel added a subtask: T418999: Remove trailing slash in issuer for bot password JWT cookies.Mar 4 2026, 4:39 PM

DAlangi_WMF changed the status of subtask T418999: Remove trailing slash in issuer for bot password JWT cookies from Open to In Progress.Mar 4 2026, 10:52 PM

• Tgr closed subtask T418999: Remove trailing slash in issuer for bot password JWT cookies as Resolved.Mar 4 2026, 11:08 PM

daniel closed subtask T410273: api rate limiting: Assign ratelimit class based on IP range as Resolved.Mar 5 2026, 6:38 PM

daniel closed subtask T417780: rest gateway: include x-wmf-* headers in response as Resolved.Mar 5 2026, 6:48 PM

daniel closed subtask T417864: haproxy: capture x-wmf-* headers in webrequest data set as Resolved.Mar 5 2026, 8:18 PM

daniel closed subtask T415007: Login with `action=login` and bot password does not create a JWT session cookie as Resolved.Mar 5 2026, 8:21 PM

JAllemandou closed subtask T418455: haproxy: capture `x_trusted_request` in webrequest data set as Resolved.Mar 9 2026, 7:45 AM

Change #1250676 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[operations/deployment-charts@master] rest-gateway: enable Mar2026 policy

https://gerrit.wikimedia.org/r/1250676

gerritbot added a project: Patch-For-Review.Mar 11 2026, 8:24 PM

Change #1250679 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[operations/deployment-charts@master] Revert: rest-gateway: enable Mar2026 policy

https://gerrit.wikimedia.org/r/1250679

Change #1250676 merged by jenkins-bot:

[operations/deployment-charts@master] rest-gateway: enable Mar2026 policy

https://gerrit.wikimedia.org/r/1250676

Change #1250679 abandoned by Daniel Kinzler:

[operations/deployment-charts@master] Revert: rest-gateway: enable Mar2026 policy

https://gerrit.wikimedia.org/r/1250679

Maintenance_bot removed a project: Patch-For-Review.Mar 12 2026, 12:30 PM

Deployed and working as expected.

daniel mentioned this in T219857: massviews hits 429 Too Many Requests despite making requests synchronously.Mon, Mar 16, 3:40 PM