Strip the port from an address, and reduce an IPv6 address to the block a subscriber holds.
An edge header often carries address:port, and that port is ephemeral: the client's operating
system picks a new one for every connection. Leaving it in the key gives each connection its own
budget, which quietly turns the limiter off, while still firing on the callers well-behaved enough
to reuse a keep-alive connection. A limiter that only punishes good clients is worse than none,
because it looks like it works.
For a bare IPv6 address, telling a trailing port from the address's last group is genuinely
ambiguous, so the key is the /64 prefix: the block a single subscriber is normally assigned, which
sidesteps the ambiguity and is the right granularity for IPv6 anyway.
Strip the port from an address, and reduce an IPv6 address to the block a subscriber holds.
An edge header often carries
address:port, and that port is ephemeral: the client's operating system picks a new one for every connection. Leaving it in the key gives each connection its own budget, which quietly turns the limiter off, while still firing on the callers well-behaved enough to reuse a keep-alive connection. A limiter that only punishes good clients is worse than none, because it looks like it works.For a bare IPv6 address, telling a trailing port from the address's last group is genuinely ambiguous, so the key is the
/64prefix: the block a single subscriber is normally assigned, which sidesteps the ambiguity and is the right granularity for IPv6 anyway.