Method CheckRateLimit

Modules/RESTAPI/src/mitkRestServer.cpp:662–753

}

bool RestServer::CheckRateLimit(const httplib::Request& req, httplib::Response& res)
{
  const auto& config = *m_RunningConfig;

  if (!config.rateLimitEnabled)
  {
    return true;
  }

  // Exempt health/info endpoints from rate limiting
  if (IsRateLimitExemptPath(req.path))
  {
    return true;
  }

  const auto now = std::chrono::steady_clock::now();
  const auto windowDuration = std::chrono::seconds(60);
  const auto windowStart = now - windowDuration;

  bool rateLimitExceeded = false;
  int retryAfterSeconds = 0;

  {
    std::lock_guard<std::mutex> lock(m_Mutex);

    // NOTE: rate limiting keys on req.remote_addr (TCP source address). Behind a NAT
    // or reverse proxy all clients share one bucket. X-Forwarded-For is intentionally
    // not used as it can be spoofed by the client.
    auto& timestamps = m_RateLimitMap[req.remote_addr];

    // Remove entries older than the window
    while (!timestamps.empty() && timestamps.front() < windowStart)
    {
      timestamps.pop_front();
    }

    if (static_cast<int>(timestamps.size()) >= config.rateLimitPerMinute)
    {
      // Calculate retry-after as seconds until the oldest entry expires
      const auto oldestExpiry = timestamps.front() + windowDuration;
      const auto retryAfter =
        std::chrono::duration_cast<std::chrono::seconds>(oldestExpiry - now).count();
      retryAfterSeconds = std::max(1, static_cast<int>(retryAfter));
      rateLimitExceeded = true;
    }
    else
    {
      // Record this request's timestamp
      timestamps.push_back(now);

      // Periodically clean up stale IP entries. NOTE: cleanup runs only every
      // kRateLimitCleanupInterval checks, so m_RateLimitMap can grow proportionally
      // to the number of unique source IPs seen between sweeps.
      ++m_RateLimitCheckCount;
      if (m_RateLimitCheckCount % kRateLimitCleanupInterval == 0)
      {
        for (auto it = m_RateLimitMap.begin(); it != m_RateLimitMap.end(); )
        {