HttpProtectOptions interface

banLimit?

number

(Optional) Requests an address may accumulate before it is banned outright.

getClientIp?

(req: Request) => string | null

(Optional) Resolver used to extract the client IP address from an incoming request. By default request-ip's getClientIp() is used, which reads the usual proxy headers (x-forwarded-for, x-real-ip, etc.).

Because bans and rate limits are keyed by this address, blindly trusting forwarded headers lets a client spoof its IP. Override this with a trust-aware resolver (for example one built on top of the proxy-addr package, configured with your known proxies) when the service is exposed behind proxies you do not fully control.

Spoofing cuts both ways here, and the second direction is the worse one. A client that varies the header evades its own counter; a client that forges someone else's address spends that address's budget and can get it banned — permanently, per HttpProtectOptions.banLimit. So on an untrusted path this option is the difference between a rate limiter and a way to have arbitrary third parties blocked.

maxRequests?

number

(Optional) Requests an address may accumulate before it is answered 429.

redis?

Redis

(Optional) An existing ioredis client to use instead of opening another connection.

redisOptions?

RedisOptions

(Optional) ioredis connection options, used only when HttpProtectOptions.redis is not given.

redisPrefix?

string

(Optional) Prefix for every Redis key this module writes.

safeNetworks?

string[]

(Optional) CIDR networks exempt from counting, limiting and banning.

ttl?

number

(Optional) Seconds of silence from an address before its request counter is forgotten.