diff --git a/middleware/rate-limit.js b/middleware/rate-limit.js index 7dbfad770e0b..e4691e6bba27 100644 --- a/middleware/rate-limit.js +++ b/middleware/rate-limit.js @@ -15,10 +15,18 @@ export default rateLimit({ // (and not following the redirect to `/en`) at roughly 200k per minute. max: 100, + // Return rate limit info in the `RateLimit-*` headers + standardHeaders: true, + // Disable the `X-RateLimit-*` headers + legacyHeaders: false, + handler: (request, response, next, options) => { const ip = request.headers['x-forwarded-for'] || request.ip const tags = [`url:${request.url}`, `ip:${ip}`] - statsd.increment('rate_limit', 1, tags) + statsd.increment('middleware.rate_limit', 1, tags) + // This is temporary until we fully understand fully that the + // rate limiter really is working in production. + response.setHeader('x-soft-rate-limit', JSON.stringify(options.store.hits)) // NOTE! At the time of writing, the actual rate limiting is disabled! // At least we can start recording how often this happens in Datadog. // The following line is commented out and replaced with `next()`