KemalIdentity::NullRateLimiter
Inherits KemalIdentity::RateLimiter < Reference < Object
Allows everything. The default.
The shard cannot pick a sensible limit on an application's behalf — a public consumer site and an internal tool with nine users want wildly different numbers — and a limiter that silently shared state across processes, or silently did not, would be worse than none.
This means rate limiting is off unless an application turns it on. That is a real gap
and it is called out in the README rather than buried here. FixedWindowRateLimiter is
the batteries-included option for a single-process deployment; anything larger wants a
shared store behind this same contract.
Instance methods
Counts one attempt against key and says whether it may proceed.
Called before any I/O and before any hashing. A denial must be cheap, or the limiter becomes the very lever it exists to remove.
Must not raise for a storage failure. A limiter whose Redis is unreachable returns
Verdict.unavailable and lets the application's configured policy decide, because the
answer differs per endpoint: a login should refuse rather than run unmetered, while a
less sensitive action may prefer to stay up. An exception here would make that choice for
everybody, and would surface as a 500 rather than as either policy.
Clears the count for key, after a successful authentication.
Idempotent, and safe for a key that was never consumed. Must not raise, including when the store is unavailable: a reset that does not happen leaves somebody throttled slightly longer than they earned, which is not worth failing a successful login over.