Package io.vertigo.vega.impl.ratelimiting

Class RateLimitingManagerImpl

java.lang.Object

io.vertigo.vega.impl.ratelimiting.RateLimitingManagerImpl

All Implemented Interfaces:

io.vertigo.core.node.component.Component, io.vertigo.core.node.component.CoreComponent, io.vertigo.core.node.component.Manager, RateLimitingManager

public final class RateLimitingManagerImpl
extends Object
implements RateLimitingManager

Component is responsible for managing rate-limiting functionality in the application. It ensures that requests from users or IPs are controlled based on predefined limits to prevent abuse and maintain system stability. Key Features Rate Limiting: - Limits the number of requests per time window (windowSeconds). - Supports daily rate limits (maxDayRequests). Modes of Operation: - nothing: Rate limiting is inactive. - logOnly: Logs requests exceeding the limit. - reject: Rejects requests exceeding the limit with an error response. - banish: Temporarily bans users/IPs exceeding the limit. Headers: Adds rate-limiting headers (X-Rate-Limit-Limit, X-Rate-Limit-Remaining, X-Rate-Limit-Reset) to responses for transparency. IP Whitelisting: Allows specific IPs to bypass rate-limiting checks. Banishment: Temporarily bans users/IPs exceeding limits, with configurable ban duration and multiplier for repeat offenders. Analytics Integration: Tracks rate-limiting events using the AnalyticsManager.

Author:

npiedeloup

Field Summary

Fields

Modifier and Type	Field	Description
static final long	DEFAULT_BANISH_MAX_SECONDS
static final int	DEFAULT_WINDOW_SECONDS

Constructor Summary

Constructors

Constructor

Description

RateLimitingManagerImpl(Optional<Integer> windowSeconds, Optional<Long> maxRequests, Optional<Long> maxDayRequests, Optional<Integer> errorCode, Optional<String> overRateLimitMode, Optional<Boolean> insertHeaders, Optional<Boolean> useForwardedFor, Optional<String> useHeaderUserIp, Optional<Boolean> useUserIp, Optional<Integer> logEveryXRequests, Optional<Long> banishSeconds, Optional<Double> banishRepeaterMult, Optional<Long> maxBanishSeconds, Optional<String> banishMessage, Optional<String> whiteListUsers, RateLimitingStorePlugin rateLimitingStorePlugin, io.vertigo.core.analytics.AnalyticsManager analyticsManager)

Constructor.

Method Summary

Modifier and Type	Method	Description
void	cancelAllBanishments()	Cancel all banishments.
void	cancelBanishment(String userKey)	Cancel banishment of a userkey.
Map<String,Instant>	getBanishments()
boolean	isActive()
boolean	preHandle(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Prehandle request.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_WINDOW_SECONDS

public static final int DEFAULT_WINDOW_SECONDS

See Also:

• Constant Field Values

DEFAULT_BANISH_MAX_SECONDS

public static final long DEFAULT_BANISH_MAX_SECONDS

See Also:

• Constant Field Values

Constructor Details

RateLimitingManagerImpl

@Inject
public RateLimitingManagerImpl(Optional<Integer> windowSeconds,
 Optional<Long> maxRequests,
 Optional<Long> maxDayRequests,
 Optional<Integer> errorCode,
 Optional<String> overRateLimitMode,
 Optional<Boolean> insertHeaders,
 Optional<Boolean> useForwardedFor,
 Optional<String> useHeaderUserIp,
 Optional<Boolean> useUserIp,
 Optional<Integer> logEveryXRequests,
 Optional<Long> banishSeconds,
 Optional<Double> banishRepeaterMult,
 Optional<Long> maxBanishSeconds,
 Optional<String> banishMessage,
 Optional<String> whiteListUsers,
 RateLimitingStorePlugin rateLimitingStorePlugin,
 io.vertigo.core.analytics.AnalyticsManager analyticsManager)

Constructor.

Parameters:

windowSeconds - Time window for rate limiting (default: 5 minutes).

maxRequests - Maximum requests allowed per window (default: 150).

maxDayRequests - Maximum requests allowed per day.

errorCode - HTTP error code to return when rate limit is exceeded (default: 429 - TOO_MANY_REQUESTS).

overRateLimitMode - Mode of operation when rate limit is exceeded (default: reject).

insertHeaders - Whether to include rate-limiting headers in responses.

useForwardedFor - Use X-Forwarded-For header for IP detection.

useHeaderUserIp - Use a custom header for IP detection.

useUserIp - Use user IP or session ID for rate-limiting.

logEveryXRequests - Number of requests after which to log rate limit exceedances (default: 100).

banishSeconds - Initial ban duration (default: 30 minutes).

banishRepeaterMult - Multiplier for repeat offenders (default: 2).

maxBanishSeconds - Maximum ban duration (default: 7 days).

banishMessage - Message returned when a user is banished (default: based on maxRequestsPerMinutes).

whiteListUsers - Comma-separated list of IPs to whitelist from rate limiting.

Method Details

isActive

public boolean isActive()

Specified by:

isActive in interface RateLimitingManager

Returns:

true if rateLimiting is active (for fast by-pass)

preHandle

public boolean preHandle(jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response)
                  throws IOException

Description copied from interface: RateLimitingManager

Prehandle request.

Specified by:

preHandle in interface RateLimitingManager

Parameters:

request - HttpRequest

response - HttpResponse

Returns:

true if request should be managed, false to stop response

Throws:

IOException

cancelBanishment

public void cancelBanishment(String userKey)

Description copied from interface: RateLimitingManager

Cancel banishment of a userkey.

Specified by:

cancelBanishment in interface RateLimitingManager

Parameters:

userKey - user key to reset

cancelAllBanishments

public void cancelAllBanishments()

Description copied from interface: RateLimitingManager

Cancel all banishments.

Specified by:

cancelAllBanishments in interface RateLimitingManager

getBanishments

public Map<String,Instant> getBanishments()

Specified by:

getBanishments in interface RateLimitingManager

Returns:

current banished userKey