You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/security/rate-limiting.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
A common technique to protect applications from brute-force attacks is **rate-limiting**. To get started, you'll need to install the `@nestjs/throttler` package.
4
4
5
5
```bash
6
-
$ npm i --save @nestjs/throttle
6
+
$ npm i --save @nestjs/throttler
7
7
```
8
8
9
9
Once the installation is complete, the `ThrottlerModule` can be configured as any other Nest package with `forRoot` or `forRootAsync` methods.
@@ -22,7 +22,7 @@ export class AppModule {}
22
22
23
23
The above will set the global options for the `ttl`, the time to live, and the `limit`, the maximum number of requests within the ttl, for the routes of your application that are guarded.
24
24
25
-
Once the module has been imported, you can then choose how you would like to bind the `ThrottlerGuard`. Any kind of binding as mentioned in the [guards](https://docs.nestjs.com/guards) section is fine. If you wanted to bind the guard globally, for example, you could do so but adding this provider to any module
25
+
Once the module has been imported, you can then choose how you would like to bind the `ThrottlerGuard`. Any kind of binding as mentioned in the [guards](https://docs.nestjs.com/guards) section is fine. If you wanted to bind the guard globally, for example, you could do so by adding this provider to any module:
26
26
27
27
```typescript
28
28
{
@@ -33,13 +33,13 @@ Once the module has been imported, you can then choose how you would like to bin
33
33
34
34
#### Customization
35
35
36
-
There may be a time where you want to bind the guard to a controller or globally, but want to avoid rate limiting one or more of your endpoints. For that, you can use the `@SkipThrottle()` decorator, to negate the throttler for an entire class or a single route. The `@SkipThrottle()` decorator can also take in a boolean for if there is a case where you want to exclude _most_ of a controller, but not every route.
36
+
There may be a time where you want to bind the guard to a controller or globally, but want to disable rate limiting for one or more of your endpoints. For that, you can use the `@SkipThrottle()` decorator, to negate the throttler for an entire class or a single route. The `@SkipThrottle()` decorator can also take in a boolean for if there is a case where you want to exclude _most_ of a controller, but not every route.
37
37
38
-
There is also the `@Throttle()` decorator which can be used to override the `limit` and `ttl` set in the global module, to give tighter or looser security options. This decorator can be used on a class or a function as well. The order for this decorator does matter, as the arguments are in the order of `limit``ttl`.
38
+
There is also the `@Throttle()` decorator which can be used to override the `limit` and `ttl` set in the global module, to give tighter or looser security options. This decorator can be used on a class or a function as well. The order for this decorator does matter, as the arguments are in the order of `limit, ttl`.
39
39
40
40
#### Websockets
41
41
42
-
This module _can_ work with websockets, but it requires some class extension. You can extend the `ThrottlerGuard` and override the `handleRequest` method like so:
42
+
This module can work with websockets, but it requires some class extension. You can extend the `ThrottlerGuard` and override the `handleRequest` method like so:
43
43
44
44
```typescript
45
45
@Injectable()
@@ -69,7 +69,7 @@ The `ThrottlerGuard` can also be used to work with GraphQL requests. Again, the
@@ -79,7 +79,7 @@ export class GqlThrottlerGuard extends ThrottlerGuard {
79
79
80
80
#### Configuration
81
81
82
-
The following options are valid for the `ThrottlerModule`
82
+
The following options are valid for the `ThrottlerModule`:
83
83
84
84
<table>
85
85
<tr>
@@ -142,4 +142,4 @@ This is doable, as long as `ThrottlerConfigService` implements the interface `Th
142
142
143
143
The built in storage is an in memory cache that keeps track of the requests made until they have passed the TTL set by the global options. You can drop in your own storage option to the `storage` option of the `ThrottlerModule` so long as the class implements the `ThrottlerStorage` interface.
144
144
145
-
> **Note**`ThrottlerStorage` can be imported from `@nestjs/throttler`.
145
+
> info **Note**`ThrottlerStorage` can be imported from `@nestjs/throttler`.
0 commit comments