More complex limits

[Hubro]

For my login API endpoint, I want to allow 1 login attempt per second, 5 attempts per hour and 10 attempts per 24 hours.

I have read through the README example and I've looked through the API, and I can't see any way to achieve this. My apologies in advance if I'm just being thick, but is this possible using this library? Would I have to stack 3 levels of the middleware?

Here's where I'm at:

func loginLimiterHandle() http.Handler {
	secondLimiter := tollbooth.NewLimiter(1, nil)

	hourLimiter := tollbooth.NewLimiter(5, nil)
	hourLimiter.SetTokenBucketExpirationTTL(1 * time.Hour)

	dayLimiter := tollbooth.NewLimiter(10, nil)
	dayLimiter.SetTokenBucketExpirationTTL(24 * time.Hour)

	handler := tollbooth.LimitFuncHandler(dayLimiter, LoginHandler)
	handler = tollbooth.LimitHandler(hourLimiter, handler)
	handler = tollbooth.LimitHandler(secondLimiter, handler)

	return handler
}

And it's only blocking 1 request per second, it's not blocking anything hourly or daily. Tested by sending 10 requests in 10 seconds.

[didip]

@Hubro Sorry for the late reply, somehow I wasn't notified by GitHub.

At it's core, Tollbooth is nothing but key-value in-memory storage with TTL.

To accomplish what you want, you need to construct your own keys and run LimitByKeys yourself. See: LimitByRequest, BuildKeys, and LimitByKeys for examples.

Re-wrapping 3 times (as what you did in the example), will simply override your key three times, which means the last one set wins (the second limiter one).

I hope that make sense.

[zhp1254]

if emailLimiterPeer == nil{
		emailLimiterPeer = tollbooth.NewLimiter(1, nil)
	}

	if emailLimiterHour == nil{
		//emailLimiterHour = tollbooth.NewLimiter(0.034, nil)
		emailLimiterHour = tollbooth.NewLimiter(2, nil)
		emailLimiterHour.SetTokenBucketExpirationTTL(1 * time.Hour)
	}

	key := strings.TrimSpace("emailLimiter:"+ctx.FormValue("email"))
	for _, l := range []*limiter.Limiter{emailLimiterPeer, emailLimiterHour} {
		httpError := tollbooth.LimitByKeys(l, []string{key})
		if httpError != nil {
			ctx.JSON(iris.Map{"error": true, "msg": "rate limit."})
			return
		}
	}

it seems not support complex limits, the above code only limit 1 per second

[ghost]

How did you solve it?