Struct RateLimitingSecurityConfig 

pub struct RateLimitingSecurityConfig {

    pub enabled: bool,
    pub requests_per_second: u32,
    pub burst_size: u32,
    pub auth_start_max_requests: u32,
    pub auth_start_window_secs: u64,
    pub auth_callback_max_requests: u32,
    pub auth_callback_window_secs: u64,
    pub auth_refresh_max_requests: u32,
    pub auth_refresh_window_secs: u64,
    pub auth_logout_max_requests: u32,
    pub auth_logout_window_secs: u64,
    pub failed_login_max_attempts: u32,
    pub failed_login_lockout_secs: u64,
    pub requests_per_second_per_user: Option<u32>,
    pub redis_url: Option<String>,
    pub trust_proxy_headers: bool,
    pub trusted_proxy_cidrs: Option<Vec<String>>,
    pub max_buckets: usize,
}

Per-endpoint and global rate limiting configuration for [security.rate_limiting].

The single shape for this section: the CLI authors it from TOML and the server consumes it from the compiled schema, so the two cannot drift (before #977 each side kept its own copy — with different defaults).

Fields

enabled: bool

Enable rate limiting.

requests_per_second: u32

Global request rate cap (requests per second, per IP).

burst_size: u32

Burst allowance above the steady-state rate.

auth_start_max_requests: u32

Auth initiation endpoint — max requests per window.

auth_start_window_secs: u64

Auth initiation window in seconds.

auth_callback_max_requests: u32

OAuth callback endpoint — max requests per window.

auth_callback_window_secs: u64

OAuth callback window in seconds.

auth_refresh_max_requests: u32

Token refresh endpoint — max requests per window.

auth_refresh_window_secs: u64

Token refresh window in seconds.

auth_logout_max_requests: u32

Logout endpoint — max requests per window (#893).

auth_logout_window_secs: u64

Logout window in seconds.

failed_login_max_attempts: u32

Maximum failed first-factor login attempts before lockout.

The off-the-shelf binary performs no first-factor login of its own, so it cannot enforce this; a value tuned away from the default is rejected at startup in production (#356) — see the server’s failed_login_lockout_check.

failed_login_lockout_secs: u64

Lockout window in seconds after failed_login_max_attempts is exceeded.

requests_per_second_per_user: Option<u32>

Per-authenticated-user request rate in requests/second. Defaults to 10× requests_per_second if not set.

redis_url: Option<String>

Redis URL for distributed rate limiting.

Optional: when unset, budgets are tracked in-memory, per process. When set, an unreachable Redis is a boot error in production (#770/#777 class) — the server does not silently downgrade to per-process limits.

trust_proxy_headers: bool

Trust X-Real-IP / X-Forwarded-For headers for client IP extraction.

Set to true only when FraiseQL is deployed behind a trusted reverse proxy that sets these headers. Enabling without a trusted proxy allows clients to spoof their IP address.

trusted_proxy_cidrs: Option<Vec<String>>

CIDR ranges trusted as proxy IPs (e.g. ["10.0.0.0/8"]).

When set and trust_proxy_headers = true, X-Forwarded-For is only honoured when the direct connection IP falls within one of these ranges. When omitted with trust_proxy_headers = true, all proxy IPs are trusted (less secure — the server emits a startup warning).

max_buckets: usize

Maximum tracked buckets per map — a memory ceiling, not a security control.

The limiter keeps one token bucket per key in each of its maps (per-IP, per-user, per-path-and-IP, per-tenant). This caps how many it holds at once, at roughly 200 bytes each: the default 100 000 is about 20 MiB per map.

Reaching the cap evicts the least-recently-used of a sample rather than refusing the newcomer (#1080/#1143), so setting it low degrades accuracy — a client whose bucket was evicted starts again with a full one — and never availability. It is a knob to size to the host, not to tune for protection.

Trait Implementations

impl Clone for RateLimitingSecurityConfig

fn clone(&self) -> RateLimitingSecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RateLimitingSecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for RateLimitingSecurityConfig

fn default() -> RateLimitingSecurityConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RateLimitingSecurityConfig

where RateLimitingSecurityConfig: Default,

fn deserialize<__D>( __deserializer: __D, ) -> Result<RateLimitingSecurityConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for RateLimitingSecurityConfig

impl PartialEq for RateLimitingSecurityConfig

fn eq(&self, other: &RateLimitingSecurityConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for RateLimitingSecurityConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for RateLimitingSecurityConfig