apache / apache/apisix

change: update the default rate limiting rejection code from 503 to 429

Open
#9,255 5 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Lua
Stars
17.1k
Forks
2.9k
Avg merge
3d 16h
Merged PRs (30d)
63

Description

### Current Behavior

Previous discussion: https://www.mail-archive.com/dev@apisix.apache.org/msg05298.html

Notably:
> The rate-limit plugin currently defaults to 503 HTTP response code for requests exceeding the configured rate limit. HTTP `429 Too Many Requests` seems to be a better fit: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429
>
> 503 was initially used because Nginx's limit_req_status also uses 503 as the default. However, Nginx made its decision long before 429 became popular.

This isn't a bug per se, but an enhancement, which has been noted that it would be a breaking change if implemented.

Plugins in scope:
* `limit-conn`
* `limit-count`
* `limit-req`

### Steps to Reproduce

https://docs.api7.ai/apisix/getting-started/rate-limiting

### Environment

APISIX version 3.2

Contributor guide

Open the contributing guide

Research direction

Start with the limit-conn, limit-count, and limit-req plugins, then read the linked rate-limiting guide and prior discussion. Done means the default rejection response for all three plugins uses HTTP 429 instead of 503, with the breaking-change impact considered.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
api, backend
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.