Compared with vendors¶
For Envoy, APISIX, Kong and other gateways you run yourself, see Why a custom proxy.
Why run this proxy if you already have Cloudflare, AWS WAF + CloudFront, Azure Front Door, Google Cloud Armor, Fastly or Akamai?
Don't run it instead of a vendor. Run it behind one when you need application policy the vendors offer only through custom edge code or Enterprise add-ons:
- exact rate limits shared by every node
- limits keyed on a verified identity
- a header contract with your services
- tested, canaried policy changes owned by the application team
If none of those matter, a vendor alone is simpler.
| Mark | Meaning |
|---|---|
| ✓ | Native |
| ◐ | Partial, or only on a tier or add-on |
| 🛠 | Only by writing edge code (Workers, Lambda@Edge, VCL, EdgeWorkers, Service Extensions) |
| ✗ | Not available |
| ? | The vendor's docs neither confirm nor rule it out |
Vendor marks link to the vendor's documentation. AFD is Azure Front Door Standard/Premium with WAF. GCA is Google Cloud Armor with Cloud Load Balancing.
Rate limiting¶
| Capability | Proxy | Cloudflare | AWS | AFD | GCA | Fastly | Akamai |
|---|---|---|---|---|---|---|---|
| Exact quota across all nodes | ✓ | ✗ per data centre | ✗ approximate | ✗ per server | ✗ per region | ✗ per POP | ◐ per node or region |
| Algorithms | ✓ 4 | ◐ undocumented | ◐ estimate, 60 to 600s | ◐ fixed, 1 or 5 min | ✓ | ◐ 1, 10, 60s | ✓ |
| Key: IP, header, cookie, query | ✓ | ◐ IP; rest Enterprise | ✓ | ◐ IP, geo | ◐ no query | ◐ IP, User-Agent | ✓ |
| Key: ASN, country | ✓ | ◐ Enterprise | ◐ ASN | ◐ geo | ✓ | 🛠 | ◐ condition only |
| Key: verified JWT claim | ✓ | ◐ Enterprise | ✗ | ✗ | ✗ | 🛠 | ✗ |
| Penalty after exceeding | ✓ | ✓ | ✗ | ◐ rest of window | ✓ | ✓ | ✓ |
| Log-only mode | ✓ | ◐ Enterprise | ✓ | ✓ | ✓ | ✓ | ✓ |
| Chosen behaviour when counting fails | ✓ | ? | ◐ fails open | ? | ? | ◐ in your code | ? |
| Per-IP backstop | ✓ | ◐ DDoS only | ◐ paid | ◐ Premium | ◐ Enterprise | ◐ add-on | ◐ add-on |
Retry-After, RateLimit headers |
✓ | ◐ Retry-After |
◐ static | ? | ✗ | 🛠 | ◐ static |
Auth, CORS, headers, responses¶
| Capability | Proxy | Cloudflare | AWS | AFD | GCA | Fastly | Akamai |
|---|---|---|---|---|---|---|---|
| JWT validation per route | ✓ | ◐ Enterprise | 🛠 | ✗ | 🛠 | 🛠 | ◐ API Gateway |
| CORS preflight answered at the edge | ✓ | 🛠 | ◐ headers only | ◐ headers only | ◐ | 🛠 | ◐ |
CORS Vary: Origin, upstream headers replaced |
✓ | ◐ | ◐ | ◐ | ? | 🛠 | ? |
| Header set, append, remove | ✓ | ◐ no append | 🛠 | ✓ | ✓ | ✓ | ✓ |
| Header copy, rename | ✓ | ✗ | 🛠 | ◐ | ✗ | 🛠 | ◐ |
| Forward only listed headers | ✓ | ✗ | ✓ | ✗ | ✗ | 🛠 | ? |
| Client can't spoof edge headers | ✓ | ◐ cf-* only |
◐ | ◐ x-fd-* only |
◐ | 🛠 | ? |
| Header values from verified claims | ✓ | ◐ Enterprise | 🛠 | ✗ | ✗ | 🛠 | ◐ unverified |
| CR/LF stripped from values | ✓ | ? | ? | ? | ◐ | ? | ? |
Locale from Accept-Language |
✓ | ◐ no matching | 🛠 | ✗ | 🛠 | 🛠 | 🛠 |
| Templated error responses | ✓ | ◐ fixed tokens | ◐ static | ◐ one body | ◐ static | 🛠 | ✓ |
| Path normalized before matching | ✓ | ✓ | ◐ | ◐ decode only | ◐ | 🛠 | ✓ opt-in |
Rules and change safety¶
| Capability | Proxy | Cloudflare | AWS | AFD | GCA | Fastly | Akamai |
|---|---|---|---|---|---|---|---|
| Rule language | ✓ | ✓ | ✓ JSON | ✓ JSON | ✓ CEL | ✓ VCL | ✓ JSON |
| Validated before activation | ✓ | ? | ? | ? | ? | ◐ VCL | ? |
| Config tests block a bad publish | ✓ | ◐ Trace | ✗ | ✗ | ✗ | ◐ simulator | ? |
| Versions and revert | ✓ | ◐ Enterprise | ✗ | ✗ | ✗ | ✓ | ✓ |
| Canary of rule changes | ✓ | ◐ Enterprise | ◐ up to 15% | ✗ | ✗ | ◐ not NGWAF | ✓ |
| Automatic rollback on errors | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ◐ during rollout |
| Audit log | ✓ | ✓ | ✓ | ? | ✓ | ✓ | ? |
| Vendor neutral | ✓ | ◐ Terraform | ◐ | ◐ Terraform | ◐ | ◐ Terraform | ◐ Terraform |
Perimeter¶
The proxy does none of this by design. Keep a vendor in front.
| Capability | Proxy | Cloudflare | AWS | AFD | GCA | Fastly | Akamai |
|---|---|---|---|---|---|---|---|
| OWASP managed rules | ✗ | ◐ from Pro | ✓ | ◐ Premium | ✓ | ◐ by tier | ✓ |
| Bot management | ✗ | ◐ by plan | ◐ paid | ◐ Premium | ◐ | ◐ add-on | ◐ add-on |
| Volumetric DDoS | ✗ | ✓ | ✓ | ✓ | ✓ | ◐ | ✓ |
| Client TLS | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
Added latency. Vendors run their rules in the POP the request already reaches. The proxy adds one network hop, plus one pipelined Valkey round trip when a rate-limit rule matches. Its own in-process work on the allow path is about 5 µs (BenchmarkAllowPath, no network). On a shared 2 vCPU machine the load tests measured an added p99 of 1.9 to 3.9 ms at 300 RPS.
Where each side wins¶
Vendors:
- The perimeter: OWASP rules, bots, volumetric DDoS, TLS and anycast at global scale.
- Nothing extra to run: no hop, no fleet, no Valkey, no admin service or Postgres.
- Mature change management on some platforms: Akamai's staging network and phased rollout, Fastly's versioned services.
The proxy:
- Exact, shared quotas. Every vendor counts per POP, server or region, and AWS, Cloudflare and Google say not to rely on it for precise limits. "5 logins per minute" means exactly 5 here.
- Limits on verified identity. Only Cloudflare Enterprise with API Shield does this natively.
- Explicit failure behaviour: open, closed or local, chosen per rule.
- An upstream header contract that clients can't spoof, without edge code.
- One policy model across clouds. Moving CDN means changing the trust preset, not rewriting rules.
- Tested changes: a failing config test blocks publish, and the canary and guard roll back degraded policy.
Both: basic IP rate limits with penalties and log-only mode, custom error bodies, static CORS headers, simple header edits and path normalization. If your needs stop there, a vendor alone is simpler and cheaper.
Decision guide¶
| Your situation | Use |
|---|---|
| Public site, approximate limits are fine, one vendor | Vendor only |
| Exact per-user or per-tenant quotas, or limits on verified identity | Vendor in front, plus this proxy |
| Several clouds or CDNs, or a planned migration | Vendor in front, plus this proxy as the portable policy layer |
| Application teams own policy and need tests, canaries and audit | This proxy |
Caveats¶
- Proxy marks are backed by the code; the exact-quota claim by
TestSharedQuotaAcrossEdgesagainst standalone and cluster Valkey. - Akamai's App & API Protector guides need a login, so its marks come from its public API, Terraform and Property Manager references.
- Fastly's JWT, CORS, locale, normalization, versions and TLS marks rest on search summaries rather than a full read of the page.
- Vendor tiers change often. Recheck them before a purchase decision.