🔒 Protect public webhooks with Ainoflow Guard rate limiting

⚡ 14 views · 🔒 SecOps & Security Automation

Description

Webhook Rate Limiter (Ainoflow Guard)

Stop webhook flooding before it starts. Add production-grade rate limiting to any n8n webhook in minutes - reject abusive traffic before expensive workflow logic executes.

✨ Key Features

🎯 How It Works

  1. Webhook receives POST request

  2. Identity extracted from headers:

    • API key (x-api-key) → per-client limiting
    • Client IP (X-Forwarded-For / x-real-ip) → per-IP limiting

  3. Guard decides allow or deny:

    • POST /api/v1/guard/{route:identity}/counter
    • Checks against configured rate limit policy

  4. Allowed → your business logic executes → 200 OK

  5. Denied → immediate 429 Too Many Requests + Retry-After header

Client → Webhook → Identity → Guard → Allowed? → Business Logic → 200 OK
                                         ↓ NO
                                    429 + Retry-After

🔧 Setup Requirements

That’s it. One credential, one API.

⚡ Quick Start

1. Import workflow and set Ainoflow Bearer credential on GuardCheck node

2. Edit Config node with your limits:

VariableDefaultDescription
rate_limit30Max requests per window
window_sec60Window in seconds
identity_modeipip or apiKey
route_namewebhookEndpoint name

3. Replace BusinessLogic node with your workflow

Access original request:

const body = $('Webhook').first().json.body;
const headers = $('Webhook').first().json.headers;

4. Activate and test

🧪 Testing

Burst Test

Bash (Linux/macOS):

for i in {1..50}; do
  curl -s -o /dev/null -w "%{http_code}\n" \
    -X POST https://your-n8n.com/webhook/rate-limited-endpoint \
    -H "Content-Type: application/json" \
    -d '{"test": true}'
done

PowerShell (Windows):

1..50 | ForEach-Object {
  (Invoke-WebRequest -Uri "https://your-n8n.com/webhook/rate-limited-endpoint" -Method POST -Body '{"test":true}' -ContentType "application/json" -UseBasicParsing).StatusCode
}

Expected: First 30 → 200, remaining → 429

Proxy Test

curl -H "X-Forwarded-For: 1.2.3.4, 5.6.7.8" \
  -X POST https://your-n8n.com/webhook/rate-limited-endpoint

Identity key should use 1.2.3.4 (first IP from chain).

💬 Response Examples

Allowed (200 OK)

{
  "ok": true,
  "data": { "message": "Request processed successfully" }
}

Denied (429 Too Many Requests)

Headers: Retry-After: 17

{
  "ok": false,
  "error": "rate_limited",
  "retryAfter": 17
}

🏗️ Workflow Architecture

SectionNodesDescription
Rate Limit CheckWebhook → Config → BuildIdentity → GuardCheck → IfAllowedExtract identity, check Guard
Allowed PathBusinessLogic → RespondOkYour logic + 200 response
Denied PathBuildDeniedResponse → RespondRateLimited429 + Retry-After

Total: 9 nodes. Minimal by design.

🔒 What This Protects Against

❌ What This Does NOT Replace

Guard handles application-level rate decisions, not network security.

🔑 Identity Modes

IP Mode (default)

Best for public webhooks where clients don’t have API keys.

X-Forwarded-For: 1.2.3.4, 5.6.7.8 → identity = "1.2.3.4"
x-real-ip: 10.0.0.1               → identity = "10.0.0.1"

⚠️ IP addresses can be shared (NAT, mobile carriers, offices).

API Key Mode

Best for authenticated endpoints with per-client keys.

x-api-key: client_abc123 → identity = "client_abc123"

Falls back to IP if header is missing.

🛠️ Customization

Rate Limit Presets

Use Caserate_limitwindow_secResult
Burst protection306030/min
API rate limiting1003600100/hour
LLM cost protection106010/min
Daily limit1000864001000/day

Multiple Endpoints

Use different route_name values to create separate rate limits:

Config A: route_name = "orders"    → key = "orders:1.2.3.4"
Config B: route_name = "payments"  → key = "payments:1.2.3.4"

Each route has independent counters.

Fail-Open vs Fail-Closed

Default: Fail-open - Guard API uses failOpen=true, so Guard outage doesn’t block traffic.

To switch to fail-closed: change failOpen query parameter to false in GuardCheck node.

Combine with Shield (Dedup Protection)

Getting duplicate webhook deliveries? Add Ainoflow Shield before your business logic - one trigger, one execution, guaranteed. Guard + Shield = rate limiting + deduplication on the same endpoint.

⚠️ Important Notes

💼 Need Customization?

Want to add temporary bans, cost protection mode, multi-tier rate limiting, or per-client usage dashboards?

Ainova Systems - We build custom AI automation infrastructure and safety layers for production workflows.

Tags: webhook, rate-limiting, security, guard, burst-protection, api-protection, ainoflow, production, webhook-security, cost-control

🔗 Nodes Used

HTTP Request, Webhook

📥 Import

Download workflow.json and import into n8n: Workflow menu → Import from File

📖 Importing guide · 🔑 Credential setup