Scenario ⑥ · Rate Limiting Rules

⏱️ This page loads = under the limit (or rate limiting not configured yet)

When the rule is active: more than 10 requests from the same IP within 10 seconds to this path (https://oldm.nc-demo.cf/demo/ratelimit.html) → the next requests are blocked for 60 seconds and return your custom 429 page.

Audience demo (repeatable, recovers automatically)

  1. Security → Rate limiting → Create rule: match URI Path contains "/demo/ratelimit.html", requests period 10 seconds, threshold 10, mitigation action Block for 60 seconds.
  2. Ask the audience to refresh this page rapidly (or mash F5) ~10+ times.
  3. The 429 page appears: "You have been rate limited. Please try again later."
  4. Wait 60 s → refreshes work again. Repeatable for the whole session.

Talk track: a burst limit protects a login endpoint or API from brute force / scraping.

← Back