How to configure hotspot parameter protection rules-Microservices Engine(MSE)-阿里云帮助中心

MSE's hot parameter throttling rules for HTTP requests allow you to apply fine-grained throttling to specific parameters in incoming requests for your web services. For applications built on mainstream web frameworks such as Servlet containers, Spring Web, or Spring Boot, MSE can parse request parameters at the API level. By configuring these rules, you can throttle resource calls based on dimensions such as client IP, host, header, or URL parameters to protect your business and system stability. This topic describes how to configure a hot parameter throttling rule for HTTP requests for an application.

Note

Hot parameter throttling rules for HTTP requests were formerly known as web application protection rules.

Background

In web service scenarios, in addition to API-level throttling and degradation, you can apply throttling to resource calls based on dimensions such as the source IP address and URL parameters. This ensures application stability. For example, in high-traffic web scenarios, you may need to limit not only the API but also requests from the most frequent source IP addresses or for the most popular product IDs. Common use cases include:

Limit requests for a frequently purchased product ID to prevent cache penetration, which can overload your database.
Limit requests from a source IP address that generates a high volume of traffic over a short period to prevent malicious activities like brushing.

Procedure

Log on to the MSE console, and select a region in the top navigation bar.
In the left-side navigation pane, choose Microservices Governance > Application Governance.
On the Application list page, click the resource card of the desired application.
On the application's page, click API Details in the left-side navigation pane. Click the Hotspot Parameter Protection (HTTP Requests) tab, and then click New Hotspot Parameter Protection (HTTP Requests).
In the New Hotspot Parameter Protection (HTTP Requests) dialog box, configure the rule parameters and click New.

For a description of the parameters, see Parameters.
In the rule list, find the rule you created and click Open in the Status column.
In the Tips dialog box, click OK to enable the protection rule.

Use case 1: Flash sale for a hot product

In scenarios like flash sales, high traffic can cause system slowdowns or crashes. To ensure system stability, you can configure a hot parameter throttling rule. If the specified threshold is exceeded, the system rejects excess requests for the hot product.

For example, to limit requests for the same product to 100 per second and reject any excess requests, configure the following rule in the New Hotspot Parameter Protection (HTTP Requests) dialog box. This rule ensures that for any single product ID, a maximum of 100 requests are allowed per second. All subsequent requests for that product within the same second are rejected, and a custom response is returned.

Set Parameter Properties to URL Parameters.

Note
For Parameter Properties, select the parameter type that corresponds to the hot product ID. For example, if a stockId field in the URL parameter corresponds to the product ID, set Parameter Properties to URL parameter, and then enter the field name in URL Parameter Name.
For URL Parameter Name, enter stockId.
Set Threshold to 100 requests per Seconds.
Set Flow Control Method to Fast failure.

Use case 2: Prevent brushing

During promotions, a large number of brushing requests can consume inventory and server resources. In this case, you can queue requests based on their source IP address. This ensures requests are processed at a steady pace, preventing excessive traffic from affecting service stability.

Configure the following rule in the New Hotspot Parameter Protection (HTTP Requests) dialog box. This rule ensures that requests from each unique source IP address are processed at a steady rate of one request every 10 ms (1 s/100 = 10 ms). Excess requests are queued. Any request queued longer than 30 ms fails immediately.

Set Parameter Properties to Client IP.
For Threshold Type, keep the default value Number of requests.
Set Threshold to 100 requests per Seconds.
Set Flow Control Method to Waiting in line.
For Timeout time, enter 30.
Set Whether to open to Enabled.

Parameters

The following table describes the parameters in the New Hotspot Parameter Protection (HTTP Requests) dialog box.

Parameter		Description
Configure Protection Rule
Parameter Properties		The request property to throttle. Valid values: Client IP: The IP address of the client that sends the request. Note If the request passes through a proxy, MSE first attempts to obtain the IP address from the `X-Forwarded-For` request header. If this header exists, MSE uses its value as the client's IP address. Remote Host: The value of the `Host` header in the request. Header: Throttling is based on a specified HTTP header. If you enter a specific header key, the rule limits requests based on the hot values for that header key. After you select Header, you can configure a matching policy for the request attribute value. Only attribute values that match the pattern are included in statistics and subject to throttling. URL Parameters: Throttling is based on a specified HTTP request parameter. You must enter the parameter name. After you select URL Parameters, you can configure a matching policy for the request attribute value. Only attribute values that match the pattern are included in statistics and subject to throttling.
(Optional) Match Pattern and Match String		If you set Parameter Properties to URL Parameters or URL Parameters, you can enable Property Value Match and specify Match Pattern and Match String. Match Pattern: accurate: Strictly matches values against the specified match string. Substring: Matches if the request attribute value contains the match string. For example, if the match string is `ab`, `aba` and `cabc` are matched, but `cba` is not. Regular: Matches values against the specified regular expression.
Threshold Type		The default value is Number of requests.
Threshold		The QPS threshold for the selected parameter. When this threshold is reached, the rule is triggered. When setting the threshold, you must also select a time interval. Valid units are second, minute, hour, and day. For example, if you set the threshold to 10 and the time interval to Points, no more than 10 requests are allowed per minute.
Advanced Options	Flow Control Method	Fast failure: When the threshold is reached, subsequent requests are immediately rejected. Note Rejected requests return the custom information configured in behavior management. If no custom behavior is configured, the default behavior applies: an HTTP 429 error code and a default text message. Waiting in line: Requests are processed at a steady rate, and excess requests are queued. You must specify a timeout. Any incoming request that cannot be processed within the specified timeout fails immediately instead of entering the queue. For example, if you set the QPS to 10, only one request can pass every 100 ms. Excess requests are queued. The timeout represents the maximum queuing time. Requests that exceed this time are rejected immediately. Note When you use the waiting in line method, do not set the QPS to exceed 1,000 (a request interval of 1 ms).
	Burst size	When you select Fast failure as the Flow Control Method, you can specify an additional burst size. This allows a specified number of extra requests to pass, accommodating sudden traffic spikes.
	Timeout time	When Flow Control Method is set to Waiting in line, you must specify a timeout in milliseconds (ms). For example, if you set the QPS to 5, only one request can pass every 200 ms, and excess requests are queued. The timeout represents the maximum queuing time. Requests that exceed this time are rejected immediately.
Whether to open		Enabled: The hot parameter throttling rule for HTTP requests is active immediately upon creation. Disabled: The hot parameter throttling rule for HTTP requests is created but remains inactive.
Configure Protection Behavior
Association Behavior		Default Behavior: This is the default option. Note If you do not need to customize the post-throttling behavior, select this option. The default behavior is to return an HTTP 429 error code with a default text message. New behavior: Add a custom post-throttling behavior. After you create the behavior, you can select it from the Association Behavior drop-down list. For more information, see Configure web behavior.