Class RateLimitFilter

java/org/apache/catalina/filters/RateLimitFilter.java:80–334

Servlet filter that can help mitigate Denial of Service (DoS) and Brute Force attacks by limiting the number of a requests that are allowed from a single IP address within a time window (also referred to as a time bucket), e.g. 300 Requests per 60 seconds. The filter works by incrementi

 * </p>
 */
public class RateLimitFilter extends FilterBase {

    /**
     * Default duration in seconds.
     */
    public static final int DEFAULT_BUCKET_DURATION = 60;

    /**
     * Default number of requests per duration.
     */
    public static final int DEFAULT_BUCKET_REQUESTS = 300;

    /**
     * Default value for enforce.
     */
    public static final boolean DEFAULT_ENFORCE = true;

    /**
     * Default value of the expose headers flag.
     */
    public static final boolean DEFAULT_EXPOSE_HEADERS = false;

    /**
     * Name of the rate limit policy header field defined in
     * <a href="https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers">RateLimit header fields for HTTP
     * (draft)</a>.
     */
    public static final String HEADER_RATE_LIMIT_POLICY = "RateLimit-Policy";

    /**
     * Name of the rate limit remaining quota header field defined in
     * <a href="https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers">RateLimit header fields for HTTP
     * (draft)</a>.
     */
    public static final String HEADER_RATE_LIMIT = "RateLimit";

    /**
     * Default status code to return if requests per duration is exceeded.
     */
    public static final int DEFAULT_STATUS_CODE = 429;

    /**
     * Default status message to return if requests per duration is exceeded.
     */
    public static final String DEFAULT_STATUS_MESSAGE = "Too many requests";

    /**
     * Request attribute that will contain the number of requests per duration.
     */
    public static final String RATE_LIMIT_ATTRIBUTE_COUNT = "org.apache.catalina.filters.RateLimitFilter.Count";

    transient RateLimiter rateLimiter;

    private String rateLimitClassName = "org.apache.catalina.util.FastRateLimiter";

    private int bucketRequests = DEFAULT_BUCKET_REQUESTS;

    private int bucketDuration = DEFAULT_BUCKET_DURATION;