docs: clarify rate limit fingerprint behavior - #837
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@davidmytton when you get a moment, take a look at the (Codex-suggested) wording here and let me know if / how I should dial it in. |
|
What are we waiting on to merge this @arcjet-rei ? |
Co-authored-by: Codex <codex@openai.com>
Regenerated by .github/workflows/playwright-update.yml. Run: https://github.com/arcjet/arcjet-docs/actions/runs/28055559642
2be1791 to
ac3a946
Compare
![arcjet-review[bot]](https://avatars.githubusercontent.com/u/24397786?s=60&v=4){kind=small}
There was a problem hiding this comment.
Arcjet Review — 🟢 Low Risk
Decision: Approved
Rationale: Documentation-only PR that adds clarifying prose and a code example to explain how multiple rate-limit characteristics combine into a single fingerprint, plus guidance to configure separate rules for independent limits. No application code, dependencies, infra, or auth logic is modified. Snapshot test files are updated to match the new docs content. No security-review concerns apply — the added TS example is illustrative and follows standard SDK usage (reads ARCJET_KEY from env, no hardcoded secrets).
Summary of Changes
Docs update explaining that Arcjet rate-limit characteristics combine into one fingerprint (not separate counters), with an example showing how to configure two independent fixedWindow rules (one per userId, one per ip.src). Adds matching notes to fingerprints.mdx, rate-limiting/index.mdx, and llms-full.txt, and refreshes the corresponding snapshot files.
Notes
Docs-only change (~40 lines of real content plus generated snapshots), well under the size threshold.
Review: 9b856154 | Model: anthropic/claude-opus-4-7 | Powered by Arcjet Review
- Raise the per-IP rule's `max` from 20 to 1000 in the two-rule example so the aggregate IP throttle sits clearly above the 100/min per-user quota. A per-IP cap below the per-user quota could block legitimate authenticated users behind shared IPs (NAT, mobile carriers, offices) before they reach their own limit. - Fix the per-page markdown (`.md`) extractor so Expressive Code blocks render as clean fenced blocks with their language annotation. Turndown was concatenating the line-number gutter into the code (e.g. `1import …2const …`); the new rule reconstructs each line from its `.code` element only. Regenerated the affected `-linux.md` llms-txt snapshots. Screenshot (.png) snapshots are regenerated separately on CI via playwright-update.yml. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Regenerated by .github/workflows/playwright-update.yml. Run: https://github.com/arcjet/arcjet-docs/actions/runs/30049861056
2 participants
Summary
Clarifies that multiple rate-limit characteristics are combined into one composite fingerprint rather than independent counters.
Adds guidance to use separate rate-limit rules when independent counters are needed, such as a user/account quota plus per-IP throttling.
Calls out the shared-IP and IP-rotation tradeoffs for authenticated traffic, and updates the llms-full reference plus markdown endpoint snapshots.