Page MenuHomePhabricator
Create Task
Maniphest T424821

rest gateway: finalize rate limits (stage three)
Open, HighPublic
Actions

Description

Set all limits to the planned values and productionize ad-hoc tooling.

See https://docs.google.com/document/d/16xtMOQoXIij5VshrXDf5N8FmFMEZwI5BfhD6mmAYvYU/edit?tab=t.xde0kat4p4xc#heading=h.27go735udow8

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
rest-gateway: tighten rate limitsDaniel Kinzleroperations/deployment-chartsmaster+25 -26
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 OpenNoneT399291 Epic: API Rate Limiting Architecture
 OpenNoneT412585 Epic: Enforce API rate limits (WE5.1.3c)
 OpendanielT424821 rest gateway: finalize rate limits (stage three)
 ResolveddanielT417779 rest gateway: enforce rate limits (stage two)
 ResolveddanielT417778 rest gateway: enforce rate limits (stage one)
 ResolveddanielT417780 rest gateway: include x-wmf-* headers in response
 ResolveddanielT417781 haproxy: strip x-wmf-* headers from responses
 ResolvedVgutierrezT417825 CDN: include x-is-browser in all requests to the backend
 ResolvedJAllemandouT417864 haproxy: capture x-wmf-* headers in webrequest data set
 Resolved• DAlangi_WMFT415007 Login with `action=login` and bot password does not create a JWT session cookie
 ResolvedTgrT418999 Remove trailing slash in issuer for bot password JWT cookies
 ResolvedJAllemandouT418455 haproxy: capture `x_trusted_request` in webrequest data set
 DuplicateNoneT418458 MW/API + haproxy: capture `x-wmf-auth-type` in webrequest data set
 ResolveddanielT410273 api rate limiting: Assign ratelimit class based on IP range
 ResolveddanielT413186 rest gateway: support multiple rate limit policies per route
 ResolveddanielT418042 rest gateway: use rlc from sessionJwt cookie even when a bearer token is used
 ResolvedTgrT417833 Set a JWT cookie for OAuth 1 requests and OAuth 2 owner-only requests
 ResolvedTgrT418606 Include session type in x-analytics header
 ResolvedmatmarexT418953 Add better error message for HTTP 429 errors to mw.Api#getErrorMessage
 ResolvedmatmarexT418957 Add client-side logging for non-MediaWiki action API errors (HTTP 429)
 ResolveddanielT418969 Rate limiting gateway should allow cross-origin requests from web browsers to read the HTTP 429 response
 ResolveddanielT419130 Exempt some routes from rate limiting and JWT validity checks in the API gateway
 ResolveddanielT419796 API rate limits: define tiers for logged-in (browser) users
 ResolveddanielT420467 rest gateway: merge "authed-other" ratelimit class into "authed-bot"
 DeclineddanielT422471 rest gateway: use IP for "compliant bots" rate limits
 ResolvedIKhitronT424422 Urgently increase Global Watchlist Live Updates mode timeout
 ResolvedamastilovicT419736 Add new API rate limiting fields from webrequest_logs to Turnilo view
 ResolveddanielT413448 [5.2.2c Epic]: Support Higher Rate Limits for Lift Wing
 OpendanielT424823 redioscope: periodically publish top clients to the data lake
 ResolveddanielT424824 api-gateway: run make test in CI
 OpendanielT424825 rest-gateway: run system tests via helm test
 ResolveddanielT424827 rest-gateway: configure comprehensive set of cg-nat IPs
 DuplicatedanielT424829 rest gateway: distinguish between compliant and non-compliant users of InstantCommons
 ResolveddanielT424828 rest gateway: implement flexible rate limit overrides
 ResolveddanielT425390 api rate limits: split anon-mediawiki from unauthed-mediawiki
 ResolveddanielT425391 api rate limits: implement more lenient limits for the Wikipedia App

Event Timeline

daniel created this task.Apr 29 2026, 10:53 AM
daniel added a subtask: T417779: rest gateway: enforce rate limits (stage two).
daniel closed subtask T417779: rest gateway: enforce rate limits (stage two) as Resolved.Apr 29 2026, 10:56 AM
daniel added a subtask: T419736: Add new API rate limiting fields from webrequest_logs to Turnilo view.Apr 29 2026, 10:58 AM
daniel added a subtask: T413448: [5.2.2c Epic]: Support Higher Rate Limits for Lift Wing.
daniel created subtask T424823: redioscope: periodically publish top clients to the data lake.Apr 29 2026, 11:08 AM
daniel created subtask T424824: api-gateway: run make test in CI.
daniel created subtask T424825: rest-gateway: run system tests via helm test.Apr 29 2026, 11:12 AM
daniel created subtask T424827: rest-gateway: configure comprehensive set of cg-nat IPs.Apr 29 2026, 11:17 AM
daniel created subtask T424828: rest gateway: implement flexible rate limit overrides.Apr 29 2026, 11:20 AM
daniel created subtask T424829: rest gateway: distinguish between compliant and non-compliant users of InstantCommons.
matmarex unsubscribed.Apr 29 2026, 12:33 PM
BPirkle moved this task from Incoming (Needs Triage) to Radar (other teams work) on the MW-Interfaces-Team board.Apr 29 2026, 1:01 PM
Blake moved this task from Inbox to Radar (Awareness) on the ServiceOps new board.Apr 30 2026, 11:25 AM
daniel created subtask T425390: api rate limits: split anon-mediawiki from unauthed-mediawiki.May 5 2026, 7:54 AM
daniel created subtask T425391: api rate limits: implement more lenient limits for the Wikipedia App.
daniel closed subtask T424828: rest gateway: implement flexible rate limit overrides as Resolved.May 8 2026, 1:38 PM
daniel closed subtask T424829: rest gateway: distinguish between compliant and non-compliant users of InstantCommons as Resolved.
daniel closed subtask T424827: rest-gateway: configure comprehensive set of cg-nat IPs as Resolved.May 8 2026, 1:41 PM
daniel closed subtask T425390: api rate limits: split anon-mediawiki from unauthed-mediawiki as Resolved.
daniel closed subtask T425391: api rate limits: implement more lenient limits for the Wikipedia App as Resolved.May 8 2026, 1:43 PM
gerritbot added a comment.May 20 2026, 2:23 PM

Change #1289992 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[operations/deployment-charts@master] rest-gateway: tighten rate limits

https://gerrit.wikimedia.org/r/1289992

gerritbot added a project: Patch-For-Review.May 20 2026, 2:23 PM
Clement_Goubert closed subtask T413448: [5.2.2c Epic]: Support Higher Rate Limits for Lift Wing as Resolved.May 26 2026, 11:10 AM
Ahoelzl closed subtask T419736: Add new API rate limiting fields from webrequest_logs to Turnilo view as Resolved.May 26 2026, 4:16 PM
gerritbot added a comment.May 27 2026, 10:06 AM

Change #1289992 merged by jenkins-bot:

[operations/deployment-charts@master] rest-gateway: tighten rate limits

https://gerrit.wikimedia.org/r/1289992

Maintenance_bot removed a project: Patch-For-Review.May 27 2026, 10:31 AM
daniel triaged this task as High priority.Jun 1 2026, 9:39 PM
daniel closed subtask T424824: api-gateway: run make test in CI as Resolved.Jun 5 2026, 12:36 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits