Class KeyValueRateLimiter

java.lang.Object
com.codename1.backend.security.ratelimit.KeyValueRateLimiter
All Implemented Interfaces:
RateLimiter
public final class KeyValueRateLimiter extends Object implements RateLimiter

Counts in the server's key/value store -- Redis once cn1.kv.url names one -- so every process of a deployment shares one limit, at one round trip per request and with no table to clean up.

http.rateLimit("/login", RateLimitKeys.clientAddress(),
        new KeyValueRateLimiter("login", 5, 60));

A fixed window, as JdbcRateLimiter counts: permits requests in each periodSeconds, counted from the first request of the window. A request is one atomic increment of a counter that expires with its window, so two processes counting at once cannot both take the last permit. A store that cannot be reached refuses nobody, as the database limiter does not.

  • Constructor Summary

    Constructors
    Constructor
    Description
    KeyValueRateLimiter(KeyValueStore store, String name, int permits, long periodSeconds)
    A limiter in store; null means the calling thread's server's store.
    KeyValueRateLimiter(String name, int permits, long periodSeconds)
    A limiter in the calling thread's server's store.

  • Method Summary

    Modifier and Type
    Method
    Description
    RateLimiter
    derive(String name, int permits, long periodSeconds)
    A limiter that keeps its counts where this one does, apart from this one's, with a limit of its own; null when this limiter cannot make one, which is what it answers unless it says more.
    void
    reset(String key)
    Forgets what was counted under key, so the next request under it is counted from nothing.
    long
    retryAfterSeconds(String key)
    How many seconds a request just refused under key should wait before trying again: what its Retry-After says.
    boolean
    tryAcquire(String key)
    Counts one request under key.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • KeyValueRateLimiter

      public KeyValueRateLimiter(String name, int permits, long periodSeconds)

      A limiter in the calling thread's server's store.

      • name: what keeps this limiter's counts apart from another's; two limiters of one name share their counts on purpose

    • KeyValueRateLimiter

      public KeyValueRateLimiter(KeyValueStore store, String name, int permits, long periodSeconds)
      A limiter in store; null means the calling thread's server's store.

  • Method Details

    • derive

      public RateLimiter derive(String name, int permits, long periodSeconds)
      Description copied from interface: RateLimiter

      A limiter that keeps its counts where this one does, apart from this one's, with a limit of its own; null when this limiter cannot make one, which is what it answers unless it says more.

      The parts of the layer that count something themselves -- attempts at a second factor, tries at a device's code -- ask the application's limiter bean for one each. That is how a bean declared to throttle an API at 600 a minute comes to count guesses at a one-time code at five in five minutes, in the same database, without the two sharing either a count or a limit.

      Specified by:
      derive in interface RateLimiter
      Parameters:
      name - what keeps the new limiter's counts apart
      permits - how many requests a key may make in a period
      periodSeconds - the length of the period

    • tryAcquire

      public boolean tryAcquire(String key)
      Description copied from interface: RateLimiter
      Counts one request under key.
      Specified by:
      tryAcquire in interface RateLimiter
      Returns:
      whether the request is within the limit

    • reset

      public void reset(String key)
      Description copied from interface: RateLimiter

      Forgets what was counted under key, so the next request under it is counted from nothing.

      A bound on wrong guesses uses this: the guess is counted before it is looked at, so that guesses made together cannot each be let through as the last one, and a right one hands the count back. A limiter that cannot forget does nothing here, which is what it does unless it says more; a right guess then costs what a wrong one does.

      Specified by:
      reset in interface RateLimiter

    • retryAfterSeconds

      public long retryAfterSeconds(String key)
      Description copied from interface: RateLimiter
      How many seconds a request just refused under key should wait before trying again: what its Retry-After says. One second unless the limiter knows better.
      Specified by:
      retryAfterSeconds in interface RateLimiter