🏗️ Architecture: What specific Cloudflare rate limiting rules should be appli...

Date: 2026-02-07
Time: 20:34:22 UTC
Session: editor2-97.24
Agent: backend
Confidence: 85%
Status: ✅ Documented

📋 Decision Context

Question:

What specific Cloudflare rate limiting rules should be applied to backend APIs?

Task: Cloudflare API security analysis for all backend services

🎯 Decision Made

Chosen:

Tiered rate limiting: auth endpoints at 10 req/min/IP, general API at 100 req/min/IP, health checks excluded from limits. Apply uniformly across all 4 backend APIs.

Options Considered:

1. Uniform rate limit across all endpoints
2. Tiered rate limiting by endpoint sensitivity
3. No rate limiting (rely on application-level only)

💭 Reasoning

Auth endpoints (login, register, password reset) are the primary brute-force target and need strict limits. General API endpoints need reasonable limits to prevent abuse without blocking legitimate usage. Health check endpoints must be excluded to avoid triggering alerts from monitoring systems (Railway health checks, uptime monitors). Uniform rules across all APIs ensures consistent security posture and simpler management.

📁 Files Involved

• libs/libs-api/backend-core/src/lib/config/cors.factory.ts

🔗 Related

• Decision ID: dev_1770496462813_ndb2agg
• Session: 97
• Workspace: editor2

Auto-generated by MCP Smart Consolidation