Rate Limit

rate-limit is an in-process token bucket. It has no external dependency and is best for single-instance gateways or cases where per-replica limiting is acceptable.

Behavior

Tokens refill at rate per second and the bucket holds up to burst tokens. Every request consumes one token. If the bucket is empty, the request returns 429 with Retry-After: 1 and:

{"error":"Rate limit exceeded"}

The bucket is shared by the middleware instance; it is not per IP, user, or tenant.

Configuration

middlewares "rate-limit" {
  type  = "rate-limit"
  rate  = 100
  burst = 50
}

Tuning

• rate controls sustained throughput.
• burst controls short spikes.
• For a global multi-replica limit, use Redis Rate Limit.

Recommended Order

middlewares = ["ip-allow", "auth-jwt", "rate-limit", "body-limit"]