Key rate limits by client address behind a proxy

At a glanceCopy Anchor Link

• Who: Developers rate-limiting public endpoints that sit behind one reverse proxy.
• What: Take the client key from the last X-Forwarded-For entry, which the proxy appended, not the spoofable first one.
• Use when: With MemoryRateLimiter behind exactly one trusted proxy that appends to the header.
• Avoid when: Behind several proxies or a CDN — use your framework's trusted-proxy setting instead.
• See also: Rate-limit calls per key

InstallCopy Anchor Link

pnpm add @zedtech/zedkit-server

Latest: 1.1.0 (via changesets).

ExampleCopy Anchor Link

import { clientKeyFromForwardedFor, MemoryRateLimiter } from "@zedtech/zedkit-server";
const limiter = new MemoryRateLimiter();
const key = clientKeyFromForwardedFor(request.headers.get("x-forwarded-for"));
if (!limiter.allow(key, 30)) return tooManyRequests();

Wraps: (none)