Skip to main content

Rate Limit

The Rate limit policy allows you to control the rate at which requests to your gateway can be made, preventing abuse and ensuring fair use of resources.

Options

rateLimitBy

Determines what method to use for rate limiting.

  • "ip": rate limit based on the client's IP address.
  • "jwt": rate limit based on the provided JWT token. It uses the sub claim as the identifier.
  • "apiKey": rate limit based on the provided API key in the x-api-key header.

Default: "ip".

Important: When selecting either the jwt or apiKey options, ensure that you have also set up the corresponding jwt or apiKey policies, respectively, to prevent any unexpected issues.

windowMs

Time frame for which requests are checked/remembered in milliseconds.

  • Number: time in milliseconds.

Default: 60000 (1 minute).

limit

The maximum number of requests allowed during the windowMs before rate limiting the client.

  • Number: the limit value.

Default: 5.

message

The response message sent back when a client is rate limited.

  • String: the message content.

Default: "Too many requests, please try again later.".

statusCode

The HTTP status code sent back when a client is rate limited.

  • Number: the status code.

Default: 429.

legacyHeaders

Whether to send legacy rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) on all responses. If set to true, the Retry-After header will also be sent on all blocked requests.

  • Boolean: true to enable, false to disable.

Default: false.

standardHeaders

Whether to enable support for headers conforming to the RateLimit header fields for HTTP standardization draft adopted by the IETF.

  • "draft-6": enable support for draft-6 headers. (i.e. RateLimit-Policy, RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset).

  • "draft-7": enable support for draft-7 headers. (i.e. a single RateLimit header containing limit, remaining, and reset values).

  • true: enable support for draft-6 headers.

If set to any truthy value, the Retry-After header will also be sent on all blocked requests.

Default: "draft-6".

skipFailedRequests

When set to true, failed requests won’t be counted.

  • Boolean: true to skip counting, false to count.

Default: false.

skipSuccessfulRequests

When set to true, successful requests won’t be counted.

  • Boolean: true to skip counting, false to count.

Default: false.

Usage

Below are the default values for the Rate Limit policy. You can use the defaults by setting rateLimit: {}, or you can customize the policy by specifying the values you want to change.

gateweaver.yml
policyDefinitions:
rateLimit:
rateLimitBy: "IP"
windowMs: 60000
limit: 5
message: "Too many requests, please try again later."
statusCode: 429
legacyHeaders: false
standardHeaders: "draft-6"
skipFailedRequests: false
skipSuccessfulRequests: false

endpoints:
- path: "/todos"
target:
url: "https://example.com/todos"
policies:
- rateLimit

Powered by express-rate-limit