Public HTTP
HTTPS addresses on raseef.run, what the gateway sends to your app, WebSockets, timeouts and limits.
Make a service public
Choose Public web (HTTPS) when you create a service, or Public HTTP under Networking in its settings, and
enter the port your app listens on. Deploy, and the service gets an address on raseef.run:
https://my-api-x7k2.raseef.runThe address is built from the service's name and four random characters. It is reserved when you create or deploy the service as public, and starts serving once a deploy succeeds. It stays the service's address until you remove it. To serve your own domain, add a custom domain.
- Plain
http://requests are redirected tohttps://with a308. - TLS 1.2 or newer, with a certificate that renews automatically.
- Requests reach your app over HTTP/1.1.
- Only HTTP and HTTPS are public. Raw TCP or UDP ports cannot be opened to the internet.
What your app receives
Raseef's gateway sits between visitors and your app. It removes any forwarding headers the visitor sent and sets its own, so your app can trust them:
| Header | Value |
|---|---|
Host | The address the visitor used, like my-api-x7k2.raseef.run or your own domain. |
X-Forwarded-For | The visitor's IP address. |
X-Forwarded-Host | Same as Host. |
X-Forwarded-Proto | https |
Frameworks read these when told to trust the proxy, for example app.set('trust proxy', 1) in Express.
WebSockets
WebSocket connections work on the same address. The gateway gives your app 10 seconds to accept the connection; after that it stays open without a time limit.
Timeouts and sizes
| The visitor must send the request headers within | 10 seconds |
| Your app must start answering within | 120 seconds, or the visitor gets 504. Silence that long in the middle of an answer closes the connection. |
| Request headers | up to 16 KiB |
| Response headers from your app | up to 64 KiB, or the visitor gets 502 |
| Request body | no limit at the gateway |
For work that takes longer than the idle timeout, start it in the background and let the client check on it, or stream progress so the connection is never silent.
Limits per visitor
The gateway is shared by every app on Raseef, so it limits each visitor's address. The limits are wide: normal traffic, including many users behind one mobile carrier address, does not reach them.
| Per visitor address | Public | From inside Raseef |
|---|---|---|
| Requests per second | 100 (bursts up to 400) | 500 (bursts up to 2,000) |
| New connections per second | 50 (bursts up to 100) | 200 (bursts up to 400) |
| Open connections | 256 | 1,024 |
- Over the request limit, the visitor gets
429 Too Many RequestswithRetry-After. Over a connection limit, the new connection is closed at once. - Each gateway counts on its own, and there are two, so a visitor spread over both can reach up to twice these numbers.
- A visitor refused for 10 seconds in a row is blocked for 10 minutes. Each new block within a day doubles, up to 24 hours. Traffic from inside Raseef is never blocked.
- IPv6 visitors are counted per
/64. WebSocket upgrades count as requests.
Requests the gateway refuses
Request bodies compressed with Brotli (Content-Encoding: br) are refused with 415. Browsers never compress what they
send, so this only affects custom clients. It protects every app from Node.js versions affected by
CVE-2026-111497.
Gateway pages
When your app cannot answer, the gateway does. Browsers get a page, other clients plain text.
| Status | When |
|---|---|
404 | Nothing is served at this address: a new app not ready yet (it is within a minute), or a stopped service. |
503 | The app cannot be reached: it is starting or restarting, or it closed the connection before answering. Sent with Retry-After: 5. |
502 | The app sent an invalid reply, or response headers that are too large. |
504 | The app did not start answering in time. |
429 | Too many requests from this visitor. |