Defense-in-depth rate limits
Local defense in depth for public endpoints.
In-process IP buckets throttle /auth/login (20/min), invitation preview plus accept (30/min shared), and password-reset request plus confirm (10/min shared). Each budget applies per source IP per brain worker, so multi-worker and multi-replica deployments multiply the effective fleet ceiling. Use a shared reverse-proxy limit when one fleet-wide ceiling is required. Inline pruning bounds each process's limiter memory, and per-account login lockout remains a second line.
z4j dashboard - Defense-in-depth rate limits
Mockup of the dashboard view for this feature. Live-reloading and themed to match your dashboard.
Ships with
- Per-IP, per-brain-worker sliding-window buckets
- Inline prune every 500 hits, no background task needed
- 120-char IP key cap defeats 10KB XFF memory attack
- Composes with per-account lockout; a reverse proxy supplies fleet-wide enforcement
Related