rate-limiting

Rate limiting blocks brute force attacks by enforcing a per-IP request budget—typically 5 requests per minute—that automatically rejects excess attempts with an HTTP 429 response. Wrap your endpoint handler with a rate-limit utility to start protecting login, signup, and password reset routes immediately.

Yes. Rate limiting stops resource-intensive operations by capping requests per IP before they accumulate into costly charges. A malicious actor hitting your AI summarization endpoint 10,000 times gets blocked after 5 attempts, preventing thousands in unexpected infrastructure costs.

Apply per-IP rate-limit budgets across routes using a helper utility like withRateLimit(). The Skill supports shared 5 requests-per-minute tracking per IP across login, signup, contact forms, newsletters, password resets, file uploads, search, data export, webhooks, and expensive operations with in-memory state management.

Yes. Rate limiting can operate behind proxies by reading the x-forwarded-for header to extract the true client IP, ensuring accurate per-IP budgets even when traffic flows through intermediaries. This prevents attackers from bypassing limits by masking their origin.

Yes. Rate limiting pairs with CSRF protection to defend endpoints against both automated abuse and cross-site request forgery. Apply both layers independently—rate limiting handles request volume; CSRF protection validates request origin and authenticity.

The endpoint responds with HTTP 429 (Too Many Requests), signaling that the client has exceeded its per-IP budget. The client must wait until the budget window resets before retrying, creating a natural throttle against spam and brute force attempts.