Rate limiting for routes

Questions and Answers
2

Hey @jasonleow,

The auth routes:

  • /connect/*
  • /auth/local
  • /auth/local/register
  • /auth/forgot-password
  • /auth/reset-password

Have the policy plugins::users-permissions.ratelimit (you linked).

Looking at the config of koa2-ratelimit middleware:

  • interval: Time Type - how long should records of requests be kept in memory. Defaults to 60000 (1 minute).
    …
  • max: max number of connections during interval milliseconds before sending a 429 response code. Defaults to 5. Set to 0 to disable.

It indeed is max 5 connections during the interval of 1 * 60 * 1000 = 60 seconds per IP per path.

3 Likes