Create Task
Maniphest T417779

rest gateway: enforce rate limits (stage two)
Open, Needs TriagePublic
Actions

Description

Switch all planned limits from "shadow mode" to enforced. Limits affect all clients except community approved bots and well-known clients identified by IP range.

See https://docs.google.com/document/d/16xtMOQoXIij5VshrXDf5N8FmFMEZwI5BfhD6mmAYvYU/edit?tab=t.xde0kat4p4xc#heading=h.27go735udow8

Details

Due Date
Wed, Apr 29, 10:00 PM

Related Objects
Search...

StatusSubtypeAssignedTask
 OpenNoneT399291 Epic: API Rate Limiting Architecture
 OpenNoneT412585 Epic: Enforce API rate limits (WE5.1.3c)
 OpenNoneT417779 rest gateway: enforce rate limits (stage two)
 ResolveddanielT417778 rest gateway: enforce rate limits (stage one)
 ResolveddanielT417780 rest gateway: include x-wmf-* headers in response
 ResolveddanielT417781 haproxy: strip x-wmf-* headers from responses
 ResolvedVgutierrezT417825 CDN: include x-is-browser in all requests to the backend
 ResolvedJAllemandouT417864 haproxy: capture x-wmf-* headers in webrequest data set
 ResolvedDAlangi_WMFT415007 Login with `action=login` and bot password does not create a JWT session cookie
 Resolved• TgrT418999 Remove trailing slash in issuer for bot password JWT cookies
 ResolvedJAllemandouT418455 haproxy: capture `x_trusted_request` in webrequest data set
 DuplicateNoneT418458 MW/API + haproxy: capture `x-wmf-auth-type` in webrequest data set
 ResolveddanielT410273 api rate limiting: Assign ratelimit class based on IP range
 ResolveddanielT413186 rest gateway: support multiple rate limit policies per route
 ResolveddanielT418042 rest gateway: use rlc from sessionJwt cookie even when a bearer token is used
 OpenNoneT418835 rest gateway: ensure sessionJwt matches bearer token
 Resolved• TgrT417833 Set a JWT cookie for OAuth 1 requests and OAuth 2 owner-only requests
 Open• TgrT418606 Include session type in x-analytics header
 ResolvedmatmarexT418953 Add better error message for HTTP 429 errors to mw.Api#getErrorMessage
 ResolvedmatmarexT418957 Add client-side logging for non-MediaWiki action API errors (HTTP 429)
 ResolveddanielT418969 Rate limiting gateway should allow cross-origin requests from web browsers to read the HTTP 429 response
 OpendanielT419130 Exempt some routes from rate limiting and JWT validity checks in the API gateway
 OpendanielT419796 API rate limits: define tiers for logged-in (browser) users
 ResolveddanielT420467 rest gateway: merge "authed-other" ratelimit class into "authed-bot"
 OpendanielT422471 rest gateway: use IP for "compliant bots" rate limits

Event Timeline

daniel created this task.Feb 18 2026, 1:34 PM
daniel edited parent tasks, added: T412585: Epic: Enforce API rate limits (WE5.1.3c); removed: T417778: rest gateway: enforce rate limits (stage one).
daniel added a subtask: T417778: rest gateway: enforce rate limits (stage one).
daniel added a subtask: T413186: rest gateway: support multiple rate limit policies per route.Feb 18 2026, 1:43 PM
daniel changed the status of subtask T413186: rest gateway: support multiple rate limit policies per route from Open to In Progress.Feb 18 2026, 1:48 PM
HCoplin-WMF moved this task from Incoming (Needs Triage) to Radar (other teams work) on the MW-Interfaces-Team board.Feb 19 2026, 2:19 AM

Moving to MWI Radar, as MWP & SRE should be responsible for this.

daniel created subtask T418042: rest gateway: use rlc from sessionJwt cookie even when a bearer token is used.Feb 21 2026, 9:23 AM
daniel added a subtask: T417833: Set a JWT cookie for OAuth 1 requests and OAuth 2 owner-only requests.Feb 21 2026, 9:38 AM
daniel closed subtask T413186: rest gateway: support multiple rate limit policies per route as Resolved.Feb 27 2026, 3:46 PM
daniel added a subtask: T418606: Include session type in x-analytics header.Feb 27 2026, 4:27 PM
daniel added a subtask: T418953: Add better error message for HTTP 429 errors to mw.Api#getErrorMessage.Mar 4 2026, 3:08 PM
daniel added a subtask: T418957: Add client-side logging for non-MediaWiki action API errors (HTTP 429).
daniel closed subtask T418042: rest gateway: use rlc from sessionJwt cookie even when a bearer token is used as Resolved.Mar 5 2026, 6:38 PM
daniel added a subtask: T419796: API rate limits: define tiers for logged-in (browser) users.Mar 12 2026, 7:35 AM
daniel closed subtask T417778: rest gateway: enforce rate limits (stage one) as Resolved.Mar 12 2026, 5:02 PM
matmarex closed subtask T418953: Add better error message for HTTP 429 errors to mw.Api#getErrorMessage as Resolved.Mon, Mar 16, 6:00 PM
daniel created subtask T420467: rest gateway: merge "authed-other" ratelimit class into "authed-bot".Wed, Mar 18, 12:47 PM
daniel closed subtask T420467: rest gateway: merge "authed-other" ratelimit class into "authed-bot" as Resolved.Thu, Mar 19, 10:34 AM
daniel closed subtask T418957: Add client-side logging for non-MediaWiki action API errors (HTTP 429) as Resolved.Fri, Mar 20, 1:44 PM
MShilova_WMF subscribed.Fri, Mar 20, 3:20 PM
gerritbot added a comment.Wed, Apr 1, 12:53 PM

Change #1266237 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[operations/deployment-charts@master] rest gateway: defined authed-user class

https://gerrit.wikimedia.org/r/1266237

gerritbot added a project: Patch-For-Review.Wed, Apr 1, 12:53 PM
daniel set Due Date to Wed, Apr 29, 10:00 PM.Tue, Apr 7, 9:23 AM
daniel created subtask T422471: rest gateway: use IP for "compliant bots" rate limits.Tue, Apr 7, 9:29 AM
daniel closed subtask T417833: Set a JWT cookie for OAuth 1 requests and OAuth 2 owner-only requests as Resolved.Wed, Apr 8, 12:54 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits