Interface: IPRateLimitConfig

Defined in: service-core/src/RateLimiter.ts:32

Configuration options for the source-IP counter layered alongside the primary, identifier-keyed one. An identifier (username/email/etc.) alone can't catch an attacker who rotates identifiers against a single source, and is itself something an attacker and a victim can share (e.g. a common username) - keying a second, independent counter on the caller's IP address closes that gap without weakening the existing per-identifier throttle. Deliberately more permissive by default than the per-identifier limit, since a single IP can legitimately represent many users behind NAT/a corporate proxy.

Properties

enabled?

optional enabled?: boolean

Defined in: service-core/src/RateLimiter.ts:34

Set to false to disable the per-IP counter. Default is true.

---

maxAttempts?

optional maxAttempts?: number

Defined in: service-core/src/RateLimiter.ts:36

The maximum number of attempts allowed from a single IP within windowSeconds. Default is 100.

---

windowSeconds?

optional windowSeconds?: number

Defined in: service-core/src/RateLimiter.ts:38

The length of the window, in seconds, that maxAttempts applies to. Default is 300 (5 minutes).