Rate Limiting based on a Cookie value

[avthart]

(How) Would it be possible to apply rate limiting based on a Cookie (e.g. correlation / session ID)?
As far as I can see, there 's no standard way to extract cookie values as arguments or headers.

[CedricConday]

Your read is right, there is no cookie selector. RateLimitSelectCondition in
api/v1alpha1/ratelimit_types.go offers exactly five fields: headers, methods, path,
sourceCIDR and queryParams.

The thing that gets you most of the way is that cookies arrive in the Cookie request header, and
HeaderMatch supports type: Distinct, which gives every unique value of that header its own rate
limit bucket:

clientSelectors:
  - headers:
      - name: Cookie
        type: Distinct

The catch is that it buckets on the whole Cookie header, so a client sending one extra or
reordered cookie lands in a different bucket than the same session would otherwise. That is fine if
the request only ever carries the one cookie, and wrong if it carries several.

For a specific cookie you need the value lifted into its own header before the rate limit filter
sees it, then type: Distinct on that header instead. type: RegularExpression on Cookie does
not substitute, because it matches the header rather than extracting a capture group, so every
session still shares one bucket.