RateLimit class

Lets a client send at most max requests in each per window. One more request gets 429 Too Many Requests with a Retry-After header (seconds). Every answer has X-RateLimit-Limit and X-RateLimit-Remaining.

Route.post('/login', <dynamic>[
  RateLimit(max: 5, per: Duration(minutes: 1)),
  authController.login,
]);

The counts live in the cache. When the default cache store of the app is Redis, the counts are shared by all isolates and servers. Else they live in memory, in each isolate.

It is a fixed window: the counter starts again at each new window (eg. each new minute). So a client can send up to 2 x max requests around the end of one window and the start of the next.

Implemented types

• IDoxMiddleware

Constructors

RateLimit({int max = 60, Duration per = const Duration(minutes: 1), RateLimitKey? key, String? name, String? store, CacheStore? cacheStore, DateTime now()?})

Properties

cacheStore → CacheStore?

a ready cache store to keep the counts, eg. in tests

final

hashCode → int

The hash code for this object.

no setter, inherited

key → RateLimitKey

the client to count for. Default is the client ip.

final

max → int

the most requests in one window

final

name → String

Two limits with the same name (and the same key) share one counter. Default is made from max and per.

final

per → Duration

the length of one window

final

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

store → String?

the name of a cache store from AppConfig.cache to keep the counts. Default: the default store when it is Redis, else memory.

final

Methods

handle(IDoxRequest req) → Future

override

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

toString() → String

A string representation of this object.

inherited

Operators

operator ==(Object other) → bool

The equality operator.

inherited