Module ratelimit

Structs§

Limit: How many failures are tolerated in a window before the key is throttled.
RateLimitConfig: Which throttles are active. Unlike AuthConfig this is on by default: an operator who never calls configure still gets protected endpoints.

DEFAULT_LOGIN_LIMIT: Password guessing: generous enough that a fat-fingered admin won’t notice.
DEFAULT_MFA_LIMIT: TOTP guessing: tighter, because the search space is only 10^6. At 5 per 15 minutes, exhausting it would take roughly 5,000 years.

configure: Override the default throttles. Call before serving: the first login or MFA attempt locks the defaults in, and a later call is ignored with a warning.
is_limited: True when key is currently throttled.
login_limit: The active password-attempt throttle, if any.
mfa_limit: The active second-factor throttle, if any.
record_failure: Count one failed attempt against key.
reset: Forget key’s failures. Called on a successful authentication so a user who eventually gets it right isn’t punished for the fumbles along the way.