Rate Limiting

Release date 2026/09/15

Feature

• Added a custom_key field for overriding the rate-limiting key entirely. The field is expressible, so it can be driven by a CEL expression, for example to rate limit by a Kong Identity Directory Principal’s metadata.

• Added support to rate limiting by Kong Identity Directory Principal.

• The second, minute, hour, day, month, and year fields are now expressible, so the rate limit value itself can be driven by a CEL expression, for example to vary the limit by a Kong Identity Directory Principal’s metadata.

Release date 2026/07/02

Bugfix

• Fixed an issue where the sync timer did not use updated configuration.

Release date 2025/07/03

Bugfix

• Fixed an issue where the rate limiting plugins can’t handle decimal numbers when using Redis strategy.

Release date 2025/08/07

Bugfix

• Fixed an issue where the rate limiting plugins can’t handle decimal numbers when using Redis strategy.

Release date 2024/12/12

Bugfix

• Fix a bug where the return values from get_redis_connection() are mistaken.

• Fixed an issue that caused an HTTP 500 error when hide_client_headers is set to true and the request exceeds the rate limit.

Release date 2024/11/04

Bugfix

• Fixed an issue that caused an HTTP 500 error when hide_client_headers is set to true and the request exceeds the rate limit.

Release date 2024/09/11

Bugfix

• Fixed an issue of DP reporting that deprecated config fields are used when configuration from CP is pushed

Release date 2024/05/28

Bugfix

• Fixed migration of redis configuration.

Release date 2024/06/18

Bugfix

• Fixed migration of redis configuration.

Release date 2024/02/12

Deprecation

• Standardize redis configuration across plugins. The redis configuration right now follows common schema that is shared across other plugins.

Feature

• add support for consumer group scoping

• support to ratelimit by consumer group

Bugfix

• fix to provide better accuracy in counters when sync_rate is used with the redis policy.

• fix an issuer where all counters are synced to the same DB at the same rate.

Release date 2023/12/21

Bugfix

• fix an issuer where all counters are synced to the same DB at the same rate.

Release date 2023/12/15

Bugfix

• fix an issuer where all counters are synced to the same DB at the same rate.

Release date 2023/09/15

Bugfix

• The redis rate limiting strategy now returns an error when Redis Cluster is down.

Release date 2022/12/06

Feature

• The HTTP status code and response body for rate-limited requests can now be customized. Thanks, @utix! #8930

Release date 2022/09/09

Bugfix

• Fixed a PostgreSQL deadlock issue that occurred when the cluster policy was used with two or more metrics (for example, second and day.)#8968

Breaking Change

• Updated the priority for some plugins.: rate-limiting changed from 901 to 910

• The default policy is now local for all deployment modes.#9344

Release date 2022/07/15

Bugfix

• Fixed a PostgreSQL deadlock issue that occurred when the cluster policy was used with two or more metrics (for example, second and day.)

Release date 2022/03/02

Feature

Bugfix

• Fixed a 500 error associated with performing arithmetic functions on a nil value by adding a nil value check after performing ngx.shared.dict operations.