Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

<@U010HRLSQRX> if you're openning an incident, it would help to throw something up on the status page :) thanks for working to resolve!

hey this looks more like a rate limiting issue do to the way your app uses the APIs, i heard that we see 40rps from one ip on your project which is triggering this - so our system behaves as expected and we don’t handle this as an outage!

but we’re still looking into this to understand which IP and why, if you’re using the ory tunnel in production that could be an issue

You can see the API calls which lead to the blocking here: <https://ory-community.slack.com/archives/C02MR4DEEGH/p1677173556838329?thread_ts=1677168407.064399&amp;cid=C02MR4DEEGH>

But it seems we may be making a lot of calls to our backend as the app starts up. Not sure how it exceeded 40RPS though :thinking_face:

Thats why I sad it’s a bit strange there are so many calls to the `whoami` endpoint. Please check your code and let use know if you can find the source.

We will put in some metrics to track the source of this