rate-limiting

Rate limiting

Adds IP- and login-based rate limiting to a Phoenix app using Hammer with the ETS backend. Installs RemoteIp for proxy-aware client IP extraction, stores the normalized IP in conn.private, and provides a MyApp.RateLimit module for IP-based throttling. It also wraps the email/password login action so repeated failed attempts for the same email are capped at 8 per minute.

When to use

• The app needs to limit how often an IP can hit a route or endpoint.
• You want to slow down credential-stuffing / brute-force login attempts.
• Don't reach for this if the app already sits behind an upstream rate limiter (API gateway, Cloudflare) that covers the same routes.

Dependencies

• Requires: authentication (the login limit wraps the generated UserSessionController).
• Recommended: None.

Install

mix saaskit.feature.install rate_limiting

No install decisions. The installer adds remote_ip and hammer to mix.exs, generates the IP extractor plug and the MyApp.RateLimit module, plugs IP extraction into the endpoint, and rewrites the login action to check the limit.

What it generates

• lib/my_app_web/plugs/client_ip_extractor.ex — MyAppWeb.Plugs.ClientIPExtractor, resolves the real client IP via RemoteIp and stores it in conn.private as :remote_ip_tuple and :remote_ip_string.
• lib/my_app/rate_limit.ex — MyApp.RateLimit (use Hammer, backend: :ets), exposes limit_by_ip/2, limit_login/2, and client_ip/1; usable as a plug.
• lib/my_app_web/endpoint.ex — plugs ClientIPExtractor right after Plug.RequestId.
• lib/my_app_web/controllers/user_session_controller.ex — the email/password login helper now calls RateLimit.limit_login/2 before checking credentials, denying after 8 attempts per email per 60 seconds.
• mix.exs — adds {:remote_ip, "~> 1.2"} and {:hammer, "~> 7.4"}.

Configuration

No config keys. Limits are passed as options at the call site. The defaults baked into MyApp.RateLimit are: