Problem Statement

The current RateLimiter middleware in gofr supports request limiting primarily based on IP address (PerIP flag).
While this works well for generic APIs, it is not sufficient for authentication and identity-based use cases such as:

• Login attempts per email
• OTP validation per user ID
• Password reset attempts per account
• API throttling per API key / tenant / user

At the moment, developers cannot easily apply rate limiting on identifiers other than IP without writing custom middleware or duplicating logic.

Current Limitation

RateLimiterConfig{
    RequestsPerSecond: 5,
    Burst:             10,
    PerIP:             true,
}