Duplicate or Conflicting X-RateLimit Headers When Upstream is Another Kong Gateway Service with Rate Limit Plugin Set

[fekitibi]

Is there an existing issue for this?

• I have searched the existing issues

Kong version ($ kong version)

3.9.0

Current Behavior

I have a gateway service which has a rate limiting plugin enabled. If I try to use that service as my upstream in a new service and I enable the rate limiting plugin on that service as well I am receiving duplicate rate limiting headers. It seems like kong appends the newly created rate limiting headers instead of overwriting them. This is confusing as it makes it unsure which headers we would need to use.

Expected Behavior

Either rename the fields of the upstream's rate limit headers, or to strip them completely and only add the rate limiting headers from the plugin of the new service. Otherwise we could also just overwrite the fields specified in the new plugin. Another approach could be to merge the headers and only showcase the shortest limits.

Either of these behaviours would be better than the current one.

Steps To Reproduce

1. Create a service
2. Create a route for the new service with a path and add a rate-limiting plugin to it with random config like 10/hour
3. Create another service and set the upstream to the path of the route we created in the previous step
4. Add a route to this service with a path and add a rate-limiting plugin to it with a config different than the previously created plugin like 20/hour
5. Call this newly created path and you will receive duplicate rate limiting headers

Anything else?

If this issue will get accepted to speed up the process I have been playing with the rate-limiting plugin code and if it would help I could open a PR with a solution either to clear the upstream's rate limit plugin headers before adding the new ones, or to just overwrite the newly set ones. If another solution would be preferred I can look into it.

[fekitibi]

I opened a PR with what I believe is the simplest fix. It removes Kong's rate-limiting headers from the response and applies only the ones configured from the plugin.