# HttpProtectOptions interface · @imqueue/http-protect

Source: https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions/
Published: 2026-08-01
Author: @imqueue maintainers (https://github.com/imqueue)
Package: @imqueue/http-protect 3.0.1 — generated reference, not hand-written

Configuration for the [HttpProtect](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect/) constructor.

**Signature:**

```typescript
export interface HttpProtectOptions 
```

## Remarks

Every option has a working default, so `new HttpProtect()` is valid — but it connects to `localhost:6379` and rate-limits on proxy-supplied headers, which is rarely what a deployed service wants.

[HttpProtectOptions.ttl](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.ttl/), [HttpProtectOptions.maxRequests](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.maxrequests/) and [HttpProtectOptions.banLimit](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.banlimit/) can each also come from an environment variable, and an option passed here wins over its variable.

## Properties


| Property | Modifiers | Type | Description |
| --- | --- | --- | --- |
| [banLimit?](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.banlimit/) |  | number | _(Optional)_ Requests an address may accumulate before it is banned outright. |
| [getClientIp?](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.getclientip/) |  | (req: Request) => string \| null | _(Optional)_ Resolver used to extract the client IP address from an incoming request. By default request-ip's getClientIp() is used, which reads the usual proxy headers (x-forwarded-for, x-real-ip, etc.). Because bans and rate limits are keyed by this address, blindly trusting forwarded headers lets a client spoof its IP. Override this with a trust-aware resolver (for example one built on top of the `proxy-addr` package, configured with your known proxies) when the service is exposed behind proxies you do not fully control. Spoofing cuts both ways here, and the second direction is the worse one. A client that varies the header evades its own counter; a client that forges someone else's address spends that address's budget and can get it banned — permanently, per [HttpProtectOptions.banLimit](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.banlimit/). So on an untrusted path this option is the difference between a rate limiter and a way to have arbitrary third parties blocked. |
| [maxRequests?](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.maxrequests/) |  | number | _(Optional)_ Requests an address may accumulate before it is answered 429. |
| [redis?](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.redis/) |  | Redis | _(Optional)_ An existing ioredis client to use instead of opening another connection. |
| [redisOptions?](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.redisoptions/) |  | RedisOptions | _(Optional)_ ioredis connection options, used only when [HttpProtectOptions.redis](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.redis/) is not given. |
| [redisPrefix?](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.redisprefix/) |  | string | _(Optional)_ Prefix for every Redis key this module writes. |
| [safeNetworks?](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.safenetworks/) |  | string\[\] | _(Optional)_ CIDR networks exempt from counting, limiting and banning. |
| [ttl?](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.ttl/) |  | number | _(Optional)_ Seconds of silence from an address before its request counter is forgotten. |