<p>I want to use rate limiter in my express server based on client IP. Let's assume, it is running in <code>Pod1</code> in a kubernetes cluster. In my express server, I check for <code>x-forwarded-for</code> header which shows correct public <code>IP</code> of client when a req comes from outside the kubernetes cluster.</p>
<p>I also have a Php symfony server running in <code>Pod2</code>. When a request comes from the Php symfony server then <code>x-forwarded-for</code> header contains <code>IP</code> of the <code>Pod2</code>.</p>
<p>My question is, how can I verify in the express server (Pod1) if a http request was originated from Php symfony server(Pod2).</p>
<p>Edit:
In my express server, I use npmjs.com/package/express-rate-limit package with redis-store to limit the request.</p>

Rohit Bohara
<p>as much as i understand you want to rate-limit the traffic to service which is running inside the POD-1.</p>
<p>there are multiple ways you can implement the rate-limiting but in your scenario if we see POD 2 will be sending the request to POD-1 on the internal network. you can not use the internal IP or <strong>cluster IP</strong> to restrict the rate-limiting.</p>
<p>to implement the rate-limiting on the internal network you can use the envoy proxy or service mesh if you are using it.</p>
<p>there is two types of rate limiting in istio using envoy proxy global and local.</p>
<p><a href="https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/#:%7E:text=Global%20rate%20limiting%20uses%20a,the%20global%20rate%20limiting%20service" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/#:~:text=Global%20rate%20limiting%20uses%20a,the%20global%20rate%20limiting%20service</a>.</p>
<p>i would suggest if you implement the instance level rate limiting you can use it using envoy local.</p>
<p><a href="https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/#local-rate-limit" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/#local-rate-limit</a></p>
<p>however there always other way around you can write code which check the Service or POD-2 IP using Kubernetes API and based on filtering count the rate-limiting. Your POD IP may get change if you re-deploy your service or deploy sprint release.</p>
<p>The above solution is not so good as it is not Agnostic You can not move your workloads out of Kubernetes without having to redesign your applications or completely rethink your infrastructure.</p>
<p>You can use the istio rate limiting if it's fit your scenario by sending the custom header in each request from <strong>POD2</strong> to <strong>POD1</strong>. you can add any value in custom headers and based on that do a rate limiting.</p>
<p>Dont write the code for adding custom header you can also do it using the istio. example : <a href="https://stackoverflow.com/questions/62727066/adding-custom-response-headers-using-istios-1-6-0-envoy-lua-filter/62752321#62752321">Adding custom response headers using Istio&#39;s (1.6.0) envoy lua filter</a></p>
<p>Example rate limiting based on key value header : <a href="https://domagalski-j.medium.com/istio-rate-limits-for-egress-traffic-8697df490f68" rel="nofollow noreferrer">https://domagalski-j.medium.com/istio-rate-limits-for-egress-traffic-8697df490f68</a></p>
