Struct RateLimitingSecurityConfig 

pub struct RateLimitingSecurityConfig {

    pub enabled: bool,
    pub requests_per_second: u32,
    pub burst_size: u32,
    pub auth_start_max_requests: u32,
    pub auth_start_window_secs: u64,
    pub auth_callback_max_requests: u32,
    pub auth_callback_window_secs: u64,
    pub auth_refresh_max_requests: u32,
    pub auth_refresh_window_secs: u64,
    pub auth_logout_max_requests: u32,
    pub auth_logout_window_secs: u64,
    pub failed_login_max_attempts: u32,
    pub failed_login_lockout_secs: u64,
    pub requests_per_second_per_user: Option<u32>,
    pub redis_url: Option<String>,
    pub trust_proxy_headers: bool,
}

Per-endpoint and global rate limiting configuration for [security.rate_limiting].

Fields

enabled: bool

Enable rate limiting

requests_per_second: u32

Global request rate cap (requests per second, per IP)

burst_size: u32

Burst allowance above the steady-state rate

auth_start_max_requests: u32

Auth initiation endpoint — max requests per window

auth_start_window_secs: u64

Auth initiation window in seconds

auth_callback_max_requests: u32

OAuth callback endpoint — max requests per window

auth_callback_window_secs: u64

OAuth callback window in seconds

auth_refresh_max_requests: u32

Token refresh endpoint — max requests per window

auth_refresh_window_secs: u64

Token refresh window in seconds

auth_logout_max_requests: u32

Logout endpoint — max requests per window

auth_logout_window_secs: u64

Logout window in seconds

failed_login_max_attempts: u32

Failed login attempts before lockout

failed_login_lockout_secs: u64

Duration of failed-login lockout in seconds

requests_per_second_per_user: Option<u32>

Per-authenticated-user request rate in requests/second. Defaults to 10× requests_per_second if not set.

redis_url: Option<String>

Redis URL for distributed rate limiting (optional — falls back to in-memory)

trust_proxy_headers: bool

Trust X-Real-IP / X-Forwarded-For headers for client IP extraction.

Set to true only when FraiseQL is deployed behind a trusted reverse proxy (e.g. nginx, Cloudflare, AWS ALB) that sets these headers. Enabling without a trusted proxy allows clients to spoof their IP address.

Trait Implementations

impl Clone for RateLimitingSecurityConfig

fn clone(&self) -> RateLimitingSecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RateLimitingSecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RateLimitingSecurityConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RateLimitingSecurityConfig

where RateLimitingSecurityConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for RateLimitingSecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.