Class: RateLimiter
Defined in: service-core/src/RateLimiter.ts:75
A simple attempt-count rate limiter used to defend expensive or guessable endpoints (credential
verification, one-time-code redemption, enumeration-prone lookups, etc.) against brute-force/abuse
attacks. Backed by Redis when a cache connection is configured (so the count is shared across server
instances), and falls back to an in-process in-memory counter otherwise.
Constructors
Constructor
new RateLimiter():
RateLimiter
Returns
RateLimiter
Properties
config
protectedconfig:RateLimiterConfig
Defined in: service-core/src/RateLimiter.ts:77
logger
protectedlogger:any
Defined in: service-core/src/RateLimiter.ts:95
trustedProxies
protectedtrustedProxies:string[] =[]
Defined in: service-core/src/RateLimiter.ts:84
Methods
checkAndIncrement()
checkAndIncrement(
identifier,config?,req?):Promise<void>
Defined in: service-core/src/RateLimiter.ts:125
Records an attempt for the given identifier and throws once it has exceeded the configured
maxAttempts within windowSeconds. A no-op when rate limiting is disabled via config.
When req is supplied, an independent, more permissive counter keyed on the caller's source IP is
also checked and incremented (see IPRateLimiterConfig) - this catches an attacker who rotates
identifiers against a single source, which the identifier-keyed counter alone cannot.
Parameters
identifier
string
A value that scopes the counter to a particular caller/target (e.g. a claimed username or email). Callers should be aware that an identifier alone can be shared by an attacker and a victim (e.g. a username), so this limits attempts against that identifier globally rather than per-source.
config?
Optional configuration that will override the service-level configuration.
req?
The source HTTP request, used to derive the caller's IP for the additional per-IP counter. Omit to check only the identifier-keyed counter (e.g. when no request is available).
Returns
Promise<void>