In-memory sliding window rate limiter.
Tracks failed attempts per key (typically IP address) using a sliding time window. No external dependencies — state resets on server restart.
7 declarations
(options?: Partial<RateLimiterOptions> | undefined): RateLimiter Create a RateLimiter with sensible defaults for per-IP login protection.
options?override individual options; unset fields use DEFAULT_LOGIN_IP_RATE_LIMIT
Partial<RateLimiterOptions> | undefinedRateLimiter RateLimiterOptions Default options for per-account login rate limiting: 10 attempts per 30 minutes.
RateLimiterOptions Default options for per-IP login rate limiting: 5 attempts per 15 minutes.
(c: Context<any, any, {}>, retry_after: number): Response Build a 429 rate-limit-exceeded JSON response with Retry-After header.
cHono context
Context<any, any, {}>retry_afterseconds until the client should retry
numberResponse a 429 Response
In-memory sliding window rate limiter.
Stores an array of timestamps per key. On check/record, timestamps
outside the window are pruned. retry_after reports seconds until the
oldest active timestamp expires.
Parameters that accept RateLimiter | null (e.g. ip_rate_limiter,
login_account_rate_limiter) silently disable rate limiting when null
is passed — no checks are performed and all requests are allowed through.
optionstype RateLimiterOptions
constructortype new (options: RateLimiterOptions): RateLimiter
optionscheckCheck whether key is allowed without recording an attempt.
type (key: string, now?: number): RateLimitResult
keyrate limit key (e.g. IP address)
stringnowcurrent timestamp in ms (defaults to Date.now())
numberDate.now()recordRecord a failed attempt for key and return the updated result.
type (key: string, now?: number): RateLimitResult
keyrate limit key (e.g. IP address)
stringnowcurrent timestamp in ms (defaults to Date.now())
numberDate.now()resetClear all attempts for key (e.g. after successful login).
type (key: string): void
keystringvoidcleanupRemove entries whose timestamps are all outside the window.
type (now?: number): void
nowcurrent timestamp in ms (defaults to Date.now())
numberDate.now()voiddisposeStop the cleanup timer. Safe to call multiple times.
type (): void
voidRateLimiterOptions Configuration for a rate limiter instance.
max_attemptsMaximum allowed attempts within the window.
numberwindow_msSliding window duration in milliseconds.
numbercleanup_interval_msInterval for pruning stale entries (0 disables the timer).
numberRateLimitResult Result of a rate limit check or record operation.
allowedWhether the request is allowed.
booleanremainingRemaining attempts before blocking.
numberretry_afterSeconds until the oldest active attempt expires (0 if allowed).
number