Package com.codename1.backend.security.ratelimit

package com.codename1.backend.security.ratelimit

Limits on how often a client may ask: a RateLimiter counts requests under a key, and a RateLimitKeyResolver says which key a request counts under -- its client's address, who it is signed in as, its session, its API key.

http.rateLimit("/login", RateLimitKeys.clientAddress(), new InMemoryRateLimiter(5, 60));

A request over its limit is answered 429 with Retry-After, before it reaches anything that costs: a password hash, a query.

Related Packages

Package	Description
com.codename1.backend.security	Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.
com.codename1.backend.security.apikey	API keys: long-lived secrets a program presents instead of signing in.
com.codename1.backend.security.crypto	Password hashing: the PasswordEncoder contract, the delegating encoder that reads the {id} in front of a stored password, and the encoders behind it.
com.codename1.backend.security.mfa	A second factor at sign-in: one-time codes from an authenticator app, and the recovery codes that stand in for a lost phone.
com.codename1.backend.security.rememberme	Remember-me: recognizing a returning user by a cookie, so that closing the browser does not sign them out.
com.codename1.backend.security.webauthn	Passkeys: signing in with a credential an authenticator holds, as the Web Authentication specification defines it.

Class	Description
InMemoryRateLimiter	A limit kept in this process's memory: a token bucket per key.
JdbcRateLimiter	Counts in the server's database, in the cn1_rate_limit table of SecuritySchema, so that every process of a deployment shares one limit.
RateLimiter	Counts requests under a key and says when there have been too many.
RateLimitKeyResolver	Says which key a request counts under.
RateLimitKeys	The keys a request is usually counted under.