Edge Security Acceleration:Limitations

Item

Description

Burst bandwidth and QPS throttling rules

if you expect ESA to handle burst bandwidth or inbound traffic surges for events like stress tests (load tests), promotions, or major launches, request additional capacity by contacting your Alibaba Cloud account manager or contact us at least 3 business days in advance. For major holidays or events, such as the Spring Festival Gala or Double 11, submit your request at least 1 month in advance.

• If your request is approved, service availability is guaranteed up to the agreed-upon capacity.

• Without an approved increase, Alibaba Cloud may throttle traffic to ensure network stability. Throttling is not guaranteed and depends on your domain's traffic patterns and the burst's scale. Alibaba Cloud is not liable for any resulting availability issues.

• Failure to secure prior approval for burst capacity may lead to the following issues:

  • A sudden increase in bandwidth may trigger ESA throttling rules. For more information, see Bandwidth limit description.

  • A sudden surge in QPS may trigger ESA DDoS protection rules. Each plan has a different maximum protection capacity. If traffic exceeds this limit, ESA may route it to a specific set of edge POPs, impacting access speed.

• Bandwidth for traffic that hits the cache is not subject to this throttling in any region. Throttling applies only to sudden increases in traffic, such as bandwidth spikes that exceed 10 Gbps.

• The default maximum bandwidth cap for ESA is at least 10 Gbps.

• As a reference for whether you need to submit a request in advance: smaller-scale stress tests or load tests, such as those with around 2,000 Mbps of traffic or a QPS of 2,000 per second, typically do not require prior reporting.

Potential risks of domain attacks and traffic abuse

By default, ESA does not provide access control or security protection. If your domain experiences a malicious attack or traffic abuse, the resulting surge in bandwidth and traffic can lead to unexpectedly high charges.

Charges that result from malicious attacks or traffic abuse are non-refundable. To mitigate this risk, see High-bill risk alert for recommended mitigations.

Site

• Format requirements:

  • The domain name must be 1 to 67 characters long.

  • The domain name must contain only lowercase letters (a-z), digits (0-9), and hyphens (-). For example, example.com.

  • Unsupported characters include Chinese characters, uppercase English letters(A-Z), and special characters other than the hyphen-. In addition, a hyphen-cannot appear consecutively, be used alone, or be the first or last character. If a domain name contains Chinese characters, you must complete the ICP filing for the domain in its Chinese format. Then, use a third-party Punycode tool to convert the Chinese domain name to its Punycode equivalent (for example, xn--fiq****.xn--eq****) and enter the converted domain name.

• ICP filing and compliance requirements:

  • ICP filing: If your acceleration region is set to Global or Chinese Mainland, you must complete an ICP filing for your domain name, regardless of the origin server's location. We recommend that you use the Alibaba Cloud ICP Filing System for this purpose. Before you proceed with the ICP filing, see Check the server for ICP filing to complete the required preparations and checks.

  • Content compliance: The content that you accelerate must be legal and comply with ESA service policies. For more information, see the Security violations and prohibited content section in this topic.

Acceleration region restrictions

If a site's Location is set to Global (Excluding the Chinese Mainland), ESA blocks user requests to its edge POPs in the Chinese Mainland.

If a site's Location is set to Chinese Mainland, ESA blocks user requests to its edge POPs outside the Chinese Mainland.

IoT card access restrictions

In accordance with regulations from the Ministry of Industry and Information Technology (MIIT) of the People's Republic of China (Notice No. 1173, 2020), ESA does not provide acceleration in the Chinese Mainland for devices that use an IoT card. As a result, these devices may fail to connect to ESA edge POP IP addresses. In addition, devices that do not support Server Name Indication (SNI), such as ESP32 4G modules, fail the TLS handshake when they access ESA. Before you connect such a device, confirm its TLS compatibility.

Security violations and prohibited content

All domains added to ESA are subject to content review. ESA does not support domains that host content in the following categories, including but not limited to:

• Sites that are inaccessible or contain no substantive content

• Private game servers

• Websites for multiplayer role-playing games and online card games

• Websites that distribute unauthorized copyrighted material, such as pirated software, novels, videos, or comics

• Peer-to-peer (P2P) lending websites

• Lottery websites

• Websites for unlicensed hospitals or the sale of unregulated pharmaceuticals

• Content related to pornography, illegal drugs, or gambling

Files

• File cache

  ESA edge POPs can cache files up to 500 GB if the origin server provides a cacheable HTTP response header.

• File upload

  The default maximum size for a file upload to an origin server through ESA is 300 MB. You can change this limit by Maximum upload size.

URL and HTTP request header size limits

For HTTP/1.1 connections, ESA configures large_client_header_buffers with number=4 and size=64 KB. Therefore, a single HTTP request header or URL cannot exceed 64 KB, and the total size of all headers plus the URL cannot exceed 256 KB (4 × 64 KB). Requests that exceed the single-item limit return a 414 status code, while requests that exceed the total size limit return a 400 status code.

Origin server HTTP response header size limit

The total size of the HTTP response header from an origin server to an ESA edge POP cannot exceed 32 KB. If a response header exceeds this limit, ESA returns a 502 status code.

Gzip and Brotli compression

ESA applies Gzip and Brotli compression only to origin server files between 1 KB and 10 MB in size.

Ports

ESA edge POPs accept traffic on the following ports:

• HTTP ports: 80, 8080, 8880, 2052, 2082, 2086, and 2095.

• HTTPS ports: 443, 2053, 2083, 2087, 2096, and 8443.

By default, ESA caches static requests only on ports 80, 443, and 8080. To enable caching on other supported ports, configure a Cache Rule and use the Custom Port Cache feature.

TCP connection timeout between a client and an ESA edge POP

The default value is 30 seconds. If the idle time of a TCP connection exceeds 30 seconds, the ESA POP actively terminates the connection.

API call limit

ESA limits calls to the CreateSite and CreateCustomHostname APIs to 100 per user per hour.

Site configuration size limit

The total size of all configuration information for a site, including global configurations, rule configurations, and certificate configurations, is limited to 512 K characters. This limit excludes rule configurations for security protection. If the total size exceeds 512 K characters, ESA returns a SiteConfigLengthExceedLimit error. To resolve this error, review the feature configurations under the site, and delete any complex or unused configuration items to reduce the total configuration size to within the limit.

Account and plan limits

• Alibaba Finance Cloud account support: ESA does not support Alibaba Finance Cloud accounts, and its interfaces are not adapted for the Finance Cloud channel. To use ESA, register a standard Alibaba Cloud public cloud account. If you have already purchased a resource plan under a Finance Cloud account, you can unsubscribe from it through the console.

• ICP filing and plan version: Accelerating a domain name within the Chinese mainland requires an ICP filing, regardless of your subscription plan or plan version (such as the Pro plan). If a domain name has not completed ICP filing, upgrading the plan does not enable acceleration for that domain name within the Chinese mainland.