Package com.codename1.backend.security.ratelimit

package com.codename1.backend.security.ratelimit

Limits on how often a client may ask: a RateLimiter counts requests under a key, and a RateLimitKeyResolver says which key a request counts under -- its client's address, who it is signed in as, its session, its API key.

http.rateLimit("/login", RateLimitKeys.clientAddress(), new InMemoryRateLimiter(5, 60));

A request over its limit is answered 429 with Retry-After, before it reaches anything that costs: a password hash, a query.

Related Packages

Package	Description
com.codename1.backend.security	Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.

Class	Description
InMemoryRateLimiter	A limit kept in this process's memory: a token bucket per key.
JdbcRateLimiter	Counts in the server's database, in the cn1_rate_limit table of SecuritySchema, so that every process of a deployment shares one limit.
RateLimiter	Counts requests under a key and says when there have been too many.
RateLimitKeyResolver	Says which key a request counts under.
RateLimitKeys	The keys a request is usually counted under.