我在API前面使用HAProxy v2.0.13，并尝试实现基于URL的速率限制，以尝试将"/get_link“路径的每个源IP的30分钟滑动窗口内的连接限制为5个：

frontend fe_dev
  mode http
  bind *:8081,[::]:8081
  stick-table type ip size 100k expire 30m store http_req_rate(30m)
  http-request track-sc0 src if METH_POST { path -i -m beg /get_link }
  http-request deny deny_status 429 if { sc_http_req_rate(0) gt 5 }
  default_backend be_dev

此API端点是使用 XMLHttpRequest() 请求从JavaScript函数调用的，而我使用的是Google Chrome v83。

var xHR = new XMLHttpRequest();
xHR.open("POST", "get_link", true);
xHR.onload = function() {
 console.log('status code is ' + this.status);
xHR.onerror = function() {
 console.log("onerror()");
var obj = {};
xHR.setRequestHeader("Content-Type", "application/json");
xHR.send(JSON.stringify(obj));

当我的POST请求的大小很小(即几百字节)时，一切工作正常-在5个请求之后，我开始得到HTTP 429的返回。然后我尝试了一个大的POST请求(内容长度大约是35500字节)，这就是Chrome开始触发 onerror 函数的时候。

我做了一个 tcpdump ，看起来HAProxy在返回429之前并不等待整个请求(为简洁起见，输出进行了调整)：

POST /get_link HTTP/1.1
Host: server:8081
Connection: keep-alive
Content-Length: 35687
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Content-Type: application/json
Accept: */*
Origin: http://server:8081
Referer: http://server:8081/index.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
{"req1":"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXHTTP/1.1 429 Too Many Requests
content-length: 117
cache-control: no-cache
content-type: text/html