Interface RateLimitDecoratorOptions

The limiter used when a rule names none. Defaults to memory.

A rule applied to every route that declares none.

Undeclared by default: a limit nobody asked for is a limit nobody sized, and the first thing it breaks is a legitimate burst.

Headers named after the caller's remaining budget, when the response can carry them.

Standard by default (RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, and Retry-After on a refusal). Set false to say nothing: a public API may prefer not to publish the shape of its budget.

The limiters this application configures.

Which request headers may carry the caller's real address, in order of preference.

Empty by default, and that default matters: a forwarded header is client-spoofable unless a proxy you trust overwrites it, so reading one by default would hand every caller an unlimited supply of identities. Name the header your own edge guarantees.