Rate Limiting

@RateLimiter from @heronjs/common bounds requests for a key within a time window. HTTP routes use native Fastify requests in 4.0.0.

import 'reflect-metadata';
import {RateLimiter} from '@heronjs/common';
import {Rest, Get} from '@heronjs/express';
 
@Rest('/health')
export class HealthController {
  @Get({uri: '/'})
  @RateLimiter({windows: 60000, max: 10, key: request => request.ip ?? 'unknown'})
  health() {
    return {ok: true};
  }
}

Register the controller in your module and configure a default cache store. Without a cache manager the HTTP rate limiter does not enforce a limit. windows is a positive duration in milliseconds, max is the positive request limit, and key is a string or function returning a string. The optional callback receives limit, remaining and reset.

The HTTP adapter keeps counters in the configured cache with an expiry for each window. A memory store keeps counters local to the process and loses them on restart. Exceeding the limit produces HTTP 429. Configure trusted proxies explicitly before relying on forwarded client addresses; Fastify proxy trust defaults to false.