OptionalbackstopThe per-address backstop that runs alongside a subject budget, as a multiple of max.
Only used when by names a subject. Deliberately generous: the subject budget is the real
guarantee, and this one only has to stop someone enumerating subjects in bulk from one machine.
Set false to run the subject budget alone.
OptionalbyWhat the budget belongs to: a field of the request ('email'), several alternatives
('phone|email', first present wins), 'user' for the authenticated principal, or 'address'
for the caller's address. Defaults to 'address'.
OptionallimiterWhich configured limiter counts this rule. Defaults to the application's default limiter.
How many requests the window allows.
OptionalscopeA bucket this rule shares with every other rule naming it, instead of one bucket per route.
Without it a rule is counted per route, which is what a route's own budget should be: two routes
declaring max: 5 are two budgets of five, not one shared between them.
That default carries a consequence worth knowing, because a rule on a group is copied onto each
child: { max: 100, window: 60 } on a group is then a hundred per child route, not a hundred
across the group. Name a scope to make it the ceiling it looks like:
@EventHandler('/api', { rateLimit: { max: 100, window: 60, scope: 'api' } })
It is not only for groups: any set of routes can share one budget by naming the same scope, which is how a write quota spanning several endpoints is expressed.
How long the window lasts, in seconds.
What a route (or a handler) declares about its budget.
maxperwindow, andbynames what the budget belongs to. The default is the caller's address, which is the only thing every request carries; naming a subject is almost always better, for the reason spelled out in RateLimitConfig.