@michaelthielemann/kestrel-ratelimit-memory 5.0.2 → 5.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -1
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -2,5 +2,9 @@
|
|
|
2
2
|
Fixed-window rate limiting per client ip, held in memory (one process). Buckets come from config:
|
|
3
3
|
`buckets: { login: { limit: 5, windowSeconds: 60 } }`. Step `ratelimit.check:<bucket>` fails
|
|
4
4
|
`RATE_LIMITED` (429, `Retry-After` from `details.retryAfterSeconds`) once the limit is reached; the
|
|
5
|
-
bucket name is validated at boot. `ratelimit.sweep` (cron) drops expired windows. Behind a proxy set
|
|
5
|
+
bucket name is validated at boot. `ratelimit.sweep` (cron) drops expired windows. Behind a proxy set
|
|
6
|
+
`http.trustProxy`/`proxyHops` or `trustedHeader` so the real client ip is used. A request without a
|
|
7
|
+
derivable address (`ctx.ip` absent – no trusted header, a forwarding chain shorter than `proxyHops`)
|
|
8
|
+
is counted in one shared key `"unknown"` per bucket, so such requests are limited together rather
|
|
9
|
+
than skipped; refusing them outright is the job of `http.allow` or the host's middleware.
|
|
6
10
|
Not included: shared limits across processes (needs a store-backed module), per-user keys.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@michaelthielemann/kestrel-ratelimit-memory",
|
|
3
|
-
"version": "5.0.
|
|
3
|
+
"version": "5.0.3",
|
|
4
4
|
"description": "Step ratelimit.check:<bucket>: fixed-window rate limiting per client ip, in memory.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -22,16 +22,16 @@
|
|
|
22
22
|
"README.md"
|
|
23
23
|
],
|
|
24
24
|
"peerDependencies": {
|
|
25
|
-
"@michaelthielemann/kestrel": "^5.0.
|
|
26
|
-
"@michaelthielemann/kestrel-contracts": "^5.0.
|
|
25
|
+
"@michaelthielemann/kestrel": "^5.0.3",
|
|
26
|
+
"@michaelthielemann/kestrel-contracts": "^5.0.3"
|
|
27
27
|
},
|
|
28
28
|
"dependencies": {
|
|
29
29
|
"zod": "^3.23.8"
|
|
30
30
|
},
|
|
31
31
|
"devDependencies": {
|
|
32
32
|
"vitest": "^3.2.0",
|
|
33
|
-
"@michaelthielemann/kestrel": "5.0.
|
|
34
|
-
"@michaelthielemann/kestrel-contracts": "5.0.
|
|
33
|
+
"@michaelthielemann/kestrel": "5.0.3",
|
|
34
|
+
"@michaelthielemann/kestrel-contracts": "5.0.3"
|
|
35
35
|
},
|
|
36
36
|
"repository": {
|
|
37
37
|
"type": "git",
|