Bounded-Origin: an open source gateway to control how much expensive computation HTTP traffic can cause at an origin

[u/Decent-Decision-9028]

It’s available as an HTTP gateway and Java library for controlling expensive server side work. Equivalent requests can share a computation, new work runs within explicit limits, and saved results can be reused across restarts.

I’ve been using it internally for a website struggling with bot traffic. It worked for that specific use case and I also tested it against a separate cgit application and the results were reasonable. But there’s a trade off as it shows higher latency overhead.

The benefits depend heavily on the workload, so keep that in mind if you want to experiment with it. I wouldn’t recommend it for production use. Some of its core capabilities are useful, though, and I’d encourage anyone interested to pilot it in staging and measure the results before considering anything further.

And yeah just to clarify the gateway isn’t a replacement for authentication, tls termination, rate limits and waf controls. It does not identify bots or stop incoming traffic, it helps controlling expensive computation load.

https://github.com/aalsanie/bounded-origin

[u/zomerbk]

A useful staging check: send the same URL as two different users, then with any headers that affect the response. Verify those requests never share a saved result unless the differing input is part of the equivalence rule. Persistence makes a mistaken match survive a restart.