patrickandClaude Sonnet 5
4a19335a1e
Replace Next.js/Supabase/Vercel stack with a self-hostable setup: Vite+React frontend, Fastify+Drizzle+PostgreSQL backend with own JWT auth, deploy via git pull + rsync + systemd (checkout/service separated, updates pulled from Gitea). Adds a reference auth route (register/login/me) as the canonical pattern for new routes. Updates all skills/rules/agents/docs to match. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BMdBJfD9TT6XUU2NqGG1PN
56 lines
1.6 KiB
Markdown
56 lines
1.6 KiB
Markdown
# Rate Limiting
|
|
|
|
Prevent abuse, brute-force, and excessive API usage.
|
|
|
|
## When to Add Rate Limiting
|
|
- **MVP:** Optional (focus on features first)
|
|
- **Production with users:** Recommended on auth endpoints and public APIs
|
|
- **Public-facing APIs:** Required
|
|
|
|
## Setup with @fastify/rate-limit
|
|
|
|
No external service needed — in-memory by default, works fine for a single backend instance.
|
|
|
|
### 1. Install Dependency
|
|
```bash
|
|
cd backend && npm install @fastify/rate-limit
|
|
```
|
|
|
|
### 2. Register Globally
|
|
```typescript
|
|
// backend/src/server.ts
|
|
import rateLimit from "@fastify/rate-limit";
|
|
|
|
await app.register(rateLimit, {
|
|
max: 100,
|
|
timeWindow: "1 minute",
|
|
});
|
|
```
|
|
|
|
### 3. Tighter Limits on Specific Routes
|
|
```typescript
|
|
// backend/src/routes/auth.ts
|
|
app.post("/api/auth/login", {
|
|
config: {
|
|
rateLimit: { max: 5, timeWindow: "1 minute" },
|
|
},
|
|
}, async (request, reply) => {
|
|
// login handler
|
|
});
|
|
```
|
|
|
|
### 4. Response on Limit Exceeded
|
|
`@fastify/rate-limit` returns HTTP 429 automatically with `Retry-After` and `X-RateLimit-*` headers — no manual handling needed.
|
|
|
|
## Recommended Limits
|
|
|
|
| Endpoint Type | Limit | Window |
|
|
|--------------|-------|--------|
|
|
| Login/Register | 5 requests | 1 minute |
|
|
| Password Reset | 3 requests | 5 minutes |
|
|
| General API | 30 requests | 10 seconds |
|
|
| File Upload | 5 requests | 1 minute |
|
|
|
|
## Multi-Instance Deployments
|
|
If the backend ever runs as more than one process/instance behind a load balancer, switch the plugin's store to Redis (`@fastify/rate-limit` supports a custom `redis` client option) so limits are shared across instances instead of per-process.
|