Fastly checks the key in Singapore
A request with no key never reaches the server in Vietnam. Press a button and watch.
Sent
–
Reached Vietnam
–
Press a button to run it.
The caller got:
-
Through Fastly:
-
Straight to the server:
-
Opens with no key, exactly like the run above. Reload as often as you like: same answer every time.
Same file, same server. Only the route differs - so the refusal is Fastly, not the server.
Proven on this page
- Junk traffic stops in Singapore, never crosses to Vietnam
- Your server spends no CPU, bandwidth or log lines refusing it
- The gate is one config change, with no edit to your application
Fastly also does - not switched on in this lab
- Rate limiting - cap how often one caller may ask
- Block or allow by country
- Hide the origin IP so it cannot be attacked directly
This is an API gateway in VCL, not a WAF: it checks a key, it does not inspect payloads or score bots. The key is shown in this page because it is a lab fixture - a real one never would be.
Sending...
sent so far
Fastly refused every one at the edge. The origin stayed idle.
The key was valid, so Fastly let it through to the origin.
Press a button to run it.
A browser address bar cannot send a header, so this link arrives with no key and the edge refuses it - the same 401 the buttons above produce.
Opens with no key, exactly like the run above. Reload as often as you like: same answer every time.