Implement the ASP.NET rate-limiter policies #56

New issue

Closed

opened 2026-07-05 19:21:26 +01:00 by TimCane · 0 comments

TimCane commented

2026-07-05 19:21:26 +01:00

(Migrated from github.com)

Goal

create-session 5/h, join 20/min, resolve-code 10/min + 100/day, global 100/min, keyed per client IP via ForwardedHeaders trusting only the proxy; 429 carries Retry-After.

References

Done when

Advances M7 A2 (burst -> 429 + Retry-After).

Part of M7: Hardening.

## Goal create-session 5/h, join 20/min, resolve-code 10/min + 100/day, global 100/min, keyed per client IP via ForwardedHeaders trusting only the proxy; 429 carries Retry-After. ## References - [docs/10-security-privacy.md#rate-limits-aspnet-rate-limiter-per-client-ip](https://github.com/TimCane/bill-splitter/blob/main/docs/10-security-privacy.md#rate-limits-aspnet-rate-limiter-per-client-ip) - [docs/07-backend-design.md](https://github.com/TimCane/bill-splitter/blob/main/docs/07-backend-design.md) ## Done when - Advances M7 A2 (burst -> 429 + Retry-After). --- Part of **M7: Hardening**.