Comment by j16sdiz

Rate limit never work like that in large volume.

Keeping connection alive take memory.

Rate limit by bytes/sec would hold the connection longer, taking more resources.

Rate limit by ip don't work with sudden surge demand, ddos, etc

Rate limit by user basically means you need to process the request and CPU bound

In very large scale DDoS, incoming SYN alone can cog your down pipe. You need to upgrade the connection just for that (Or something on your upstream to block by ip)

You can do lots of these without using cdn, yes. But it is easier with cdn and it is cheaper than paying for extra capacity "just in case"