Skip to main content

Rate Limit

The Rate limit policy allows you to control the rate at which requests to your Server can be made, preventing abuse and ensuring fair use of resources.

Options​

rateLimitBy​

Determines what method to use for rate limiting.

  • "ip": rate limit based on the client's IP address.
  • "jwt": rate limit based on the provided JWT token. It uses the sub claim as the identifier.
  • "apiKey": rate limit based on the provided API key in the x-api-key header.

Default: "ip".

Important: When selecting either the jwt or apiKey options, ensure that you have also set up the corresponding jwt or apiKey policies, respectively, to prevent any unexpected issues.

windowMs​

Time frame for which requests are checked/remembered in milliseconds.

  • Number: time in milliseconds.

Default: 60000 (1 minute).

limit​

The maximum number of requests allowed during the windowMs before rate limiting the client.

  • Number: the limit value.

Default: 5.

message​

The response message sent back when a client is rate limited.

  • String: the message content.

Default: "Too many requests, please try again later.".

statusCode​

The HTTP status code sent back when a client is rate limited.

  • Number: the status code.

Default: 429.

legacyHeaders​

Whether to send legacy rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) on all responses. If set to true, the Retry-After header will also be sent on all blocked requests.

  • Boolean: true to enable, false to disable.

Default: false.

standardHeaders​

Whether to enable support for headers conforming to the RateLimit header fields for HTTP standardization draft adopted by the IETF.

  • "draft-6": enable support for draft-6 headers. (i.e. RateLimit-Policy, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset).

  • "draft-7": enable support for draft-7 headers. (i.e. a single RateLimit header containing limit, remaining, and reset values).

  • true: enable support for draft-6 headers.

If set to any truthy value, the Retry-After header will also be sent on all blocked requests.

Default: "draft-6".

skipFailedRequests​

When set to true, failed requests won’t be counted.

  • Boolean: true to skip counting, false to count.

Default: false.

skipSuccessfulRequests​

When set to true, successful requests won’t be counted.

  • Boolean: true to skip counting, false to count.

Default: false.

Usage​

gateweaver.yml
policyDefinitions:
  rateLimit:
    windowMs: 300000
    limit: 100
    message: "You have exceeded the 100 requests in 5 minutes limit!"

endpoints:
  - path: "/todos"
    target:
      url: "https://jsonplaceholder.typicode.com/todos"
    policies:
      - rateLimit

Powered by express-rate-limit