interface RateLimitOptions

Options for rate limiting middleware.

Properties

readonly
windowMs: number

Time window in milliseconds.

readonly
max: number

Max requests per window per key.

readonly
optional
store: RateLimitStore

Custom store implementation. If omitted, a MemoryRateLimitStore is built lazily.

readonly
optional
keyGenerator: (ctx: IRequestContext) => string

Key generator function. Defaults to defaultRateLimitKey, which prefers the authenticated principal, then the client IP published by ipSecurityMiddleware, then IRequest.ip, and only then 'anonymous'.

Supply your own when none of those identify a caller in your deployment — an 'anonymous' key makes the limiter a single GLOBAL counter (see the note on defaultRateLimitKey).

readonly
optional
message: string

Message returned in the 429 body.

readonly
optional
standardHeaders: boolean

Emit standard RateLimit-* headers (default: true).

Since 0.5.0
readonly
optional
exclude: readonly PathPattern[]

Paths exempted from the limiter, matched against IRequest.path. A string is an EXACT match; a RegExp is tested against the path.

Omitted, this is DEFAULT_RATE_LIMIT_EXCLUDED_PATHS — the six operational paths the framework's own plugins serve. That default exists because the limiter is documented as a global middleware and the CLI scaffolds Kubernetes probes pointing at /live and /ready: without it, an exhausted bucket answers the liveness probe 429 and the kubelet restarts a container whose only fault is that it is under load.

Pass [] to exempt nothing, which is the pre-0.5.0 behaviour.

Usage

import { type RateLimitOptions } from "auth-plugin/src/index.ts";