20 days ago
Hi,
Every HTTP request to my service is being refused at the Railway edge with
429 "rate limited". No request reaches my application at all. TCP traffic to
my Postgres service on the same project works normally.
Account: dev@mobilityhubafrica.com
Workspace: Tech Dev's Projects (personal) — 03cd24a7-b2df-4c60-a8ec-50a1a70d89ac
Project: endearing-bravery — 12d744f6-b89c-4d16-ba40-e5b49b01754e
Environment: production — d6344613-67a0-4dc8-914a-f74669c091c1
Service: mba-backend — def9723c-579f-4276-85f2-05aafdbdb977
Domain: mba-backend-production.up.railway.app (target port 3000)
Trace IDs for two refused requests, ~21 hours apart and from different edges:
x-hikari-trace: jnb1.w0as — Fri, 31 Jul 2026 18:43:11 GMT
x-hikari-trace: bcn1.h9g5 — Sat, 01 Aug 2026 15:43:29 GMT
Response received for every request, including /health and paths that do not
exist in my app:
HTTP/2 429
content-type: text/plain; charset=utf-8
content-length: 12
server: railway-hikari
x-railway-edge: bcn1
rate limited
Why I believe this is not my application:
-
My app's own rate limiter returns JSON, not plain text, and always sets
RateLimit-* headers. This response has neither.
-
/health in my app has no rate limiter and no dependencies. A request to a
route that does not exist in my app returns the same 429, so routing never
reaches my code.
-
The HTTP log stream for the service is completely empty — the proxy has
never forwarded a request to the application.
-
The behaviour is identical across two different edge locations (jnb1, bcn1)
and has persisted for more than 24 hours.
-
Postgres on the same project is reachable and serving normally over the TCP
proxy (reseau.proxy.rlwy.net:20853), so only the HTTP edge is affected.
Likely relevant: until today my service had a misconfigured start command
(prisma migrate deploy, which exits immediately instead of starting a
server). The container therefore exited and was restarted repeatedly for
roughly a day. I suspect that restart loop tripped an automatic protection at
the edge.
That misconfiguration is now fixed. The current deployment
(b2bf0136-5051-435e-b72c-da05c975b446, SUCCESS at 2026-08-01T16:47Z) has:
startCommand npm start (node dist/index.js)
preDeployCommand npx prisma migrate deploy
healthcheckPath /health
The build completes cleanly and the pre-deploy migration step succeeds
("No pending migrations to apply", connected over postgres.railway.internal).
Could you please:
-
Confirm whether a rate limit, throttle or usage restriction is currently
applied to this project, service or workspace, and clear it if the cause
was the restart loop described above.
-
Confirm my plan/usage state is not the cause — if a trial or credit
allowance has been exhausted, please say so directly and I will resolve it
on my side.
Thanks,
Nana Yaw
1 Replies
20 days ago
Your service has Under Attack Mode enabled (set to stay on until manually disabled). This is a WAF feature that requires every visitor to pass a browser check before requests reach your service. Since mba-backend is an API, all non-browser traffic is turned away at the edge, which produces the 429 you are seeing on every path. There are no restrictions or throttles on your workspace or service. To fix this, go to your service's Settings, find the Edge section, and click Deactivate under Under Attack Mode. Traffic should start reaching your application within about 20 seconds.
Status changed to Awaiting User Response Railway • 20 days ago
13 days ago
This thread has been marked as solved automatically due to a lack of recent activity. Please re-open this thread or create a new one if you require further assistance. Thank you!
Status changed to Solved Railway • 13 days ago