Security limits
Reference limits for Easel firewall rules, Attack Mode, and related controls.
These limits describe current platform behavior that affects security configuration and challenge flows.
Attack Mode
| Limit | Value |
|---|---|
| Challenge response status | 429 |
| Verification endpoint | POST /.well-known/easel-challenge/verify |
| Session cookie | easel_ch_pass |
| Verification session lifetime | About 1 hour |
| Work-token lifetime | About 15 minutes |
Challenge difficulty is platform-managed and may change.
Deployment protection
| Limit | Value |
|---|---|
| Session cookie | easel_dp |
| Session lifetime | About 1 hour |
Request size
Large request bodies are rejected before they can exhaust edge or application resources. The default maximum request body size is 10 MiB unless otherwise configured for the platform.
Firewall rules
Custom rules are ordered per project. There is no separate priority number beyond list order.
Practical guidance:
- Prefer fewer, well-scoped rules over many overlapping ones
- Validate regex rules with Log before enforcing
- Combine path and method conditions before broad IP or country denies
Plan-specific quotas for rule count, IP lists, and log retention may be published separately as product packaging evolves.
Geographic data
| Field | Support |
|---|---|
| Country | Supported in custom rules |
| Continent | Supported in custom rules |
| ASN | Supported in custom rules |
| Region / city | Not available as firewall conditions |
Geo and ASN data is powered by IPLocate.io (CC BY-SA 4.0). Accuracy can vary for VPNs, proxies, and mobile networks. Unknown locations do not match equality conditions unless you account for that explicitly.
Propagation
Firewall and Attack Mode configuration changes save on the project and propagate to the edge after a short delay. You do not need to redeploy. Allow a brief window before expecting every region to serve the latest rules.