rest gateway: emit status 401 when the rate limit is 0
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	daniel
	Jun 4 2026, 3:06 PM

Project Tags

Referenced Files

None

Subscribers

Description

When a rate limit policy specifies 0 as the limit for a certain user class, the response status should be 401, not 429.
This can be implemented in a way similar to how we add the retry-after header, be examininhg the x-ratelimit-xxx response headers to determin the rate limit, and updating the status of that limit is 0.

Open question: should it be 401 or 403? 401 makes sense if the limit is non-zero for authenticated clients. 403 makes sense in cases where e.g. only internal traffic is allowed. Perhaps that can be an option in the rate limit policy.

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	rest-gateway: emit 401 if rate limit is 0	Daniel Kinzler	operations/deployment-charts	master	+275 -18

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Resolved	BWojtowicz-WMF	T426749 Access control for LiftWing LLM services exposed to external clients through REST Gateway
Open	None	T399291 Epic: API Rate Limiting Architecture
Resolved	daniel	T428184 rest gateway: emit status 401 when the rate limit is 0

Event Timeline

daniel created this task.Jun 4 2026, 3:06 PM

daniel added a parent task: T399291: Epic: API Rate Limiting Architecture.

As part of my Clinic Duty rotation, I am moving this task to "Radar (other teams work)". I am also adding the project tag "MediaWiki-Platform-Team (Radar)" because the parent task T399291: Epic: API Rate Limiting Architecture has that project tag. Anybody can let me know if these edits are incorrect.

A summary of notes:

An internal MediaWiki team member identified this issue.
I see the logic that 401 or 403 would be more accurately informative to a user.
- 429 tells a message of: The rate limit is non-zero, and you have temporarily exceeded it.
- 401 tells a message of: You are not authenticated, and authentication could change the outcome such that you get a non-zero rate limit.
- 403 tells a message of: Authentication would not change the outcome of what rate limit you get. Based on what we know about you, such as traffic class or network location, the server refuses to fulfill your request.
  - In this case, even if the client authenticates, the authentication would not grant access. It would be misleading to signal that authentication would make a difference.
- Therefore, a key question to help decide whether 401 or 403 is better in a scenario may be: Would this client receive a non-zero rate limit if it authenticated?