Struct AuthRateLimiter 

pub struct AuthRateLimiter { /* private fields */ }

Per-IP auth attempt tracker with sliding window and lockout.

Implementations

impl AuthRateLimiter

pub fn new() -> Self

pub fn check_rate_limit( &self, key: &str, peer_is_loopback: bool, ) -> Result<(), RateLimitError>

Check whether the client identified by key is allowed to attempt auth.

peer_is_loopback must reflect the socket peer (never a value derived from client-supplied headers). When true, rate limiting is skipped — local administrators may retry freely. Trusting a header-derived loopback value would let an attacker spoof X-Forwarded-For: 127.0.0.1 to bypass the lockout.

Does not record a new attempt — call [record_attempt] after verifying the attempt actually happened (regardless of success/failure).

pub fn record_attempt(&self, key: &str, peer_is_loopback: bool)

Record a new authentication attempt for key.

See check_rate_limit for peer_is_loopback semantics. Only the socket peer may be trusted as loopback.

pub fn is_locked_out(&self, key: &str, peer_is_loopback: bool) -> bool

Check whether key is currently locked out, without recording anything.

See check_rate_limit for peer_is_loopback semantics. Only the socket peer may be trusted as loopback.

Trait Implementations

impl Debug for AuthRateLimiter

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for AuthRateLimiter

fn default() -> Self

Returns the “default value” for a type.