Rate limiting#

You declare it on the route. It applies where you wrote it, and nowhere else.

// a single route
post("/api/login", handler)
	.attribute(RateLimit.KEY, RateLimit.perIp(5, Duration.ofMinutes(1)));

// the whole block
path("/api", () -> {
	rateLimit(RateLimit.perIp(60, Duration.ofMinutes(1)));

	get("/items", handler);
	get("/items/{id}", handler);
});

Like before, it attaches to the block you wrote it in (not to a node in the path). Write another one further in and the inner one wins; if the route carries one as an attribute, that wins.

How it counts#

It is a token bucket. It refills up to limit over duration. A short burst gets through; hammer it and you are stopped.

What it counts by#

RateLimit.perIp(60, Duration.ofMinutes(1));                       // per source address
RateLimit.of(context -> context.session().id(), 10, Duration.ofMinutes(1));   // per login

Things you do not want counted, such as access from inside the office, can be excluded.

RateLimit.perIp(60, Duration.ofMinutes(1))
	.exclude(context -> context.request().proxyAddress().startsWith("10."));

What comes back when it stops you#

It stops the request before before runs. So it never reaches your authentication or your DB.

Where the counters live#

rate_limit {
	store   = "memory"   # memory | redis | db
	enabled = true
}