Module login_ratelimit 

Per-account throttles on password authentication.

Every password attempt reserves a token from the account’s failed-attempt bucket before the password is checked, and only a wrong password keeps it, so concurrent guesses cannot share one token. Only a sign-in by a verified password debits the account bucket. Both are keyed on the account rather than the client address, mirroring Synapse’s rc_login.failed_attempts and rc_login.account; the operator documentation for the [global.rate_limiting.login] options sets out their costs.

Structs

Limit 🔒

One bucket’s configuration: refill rate per second and burst depth.

Reservation

A failed-attempt token reserved for one password attempt.

Service

Per-account login throttles.

Table 🔒

One axis’s token buckets, and where the next prune of them resumes.

Enums

Axis 🔒

Which bucket table a debit addresses, deciding its full-table policy.

Hold 🔒

Whether a reservation actually took a token.

Constants

FULL_WARNING_INTERVAL 🔒

How often each table’s full-table warning may repeat while it stays full.

MAX_RETRY_AFTER 🔒

The longest retry_after a refusal will state, whatever the rate.

PRUNE_SAMPLE 🔒

How many entries one admission inspects when the table is full.

RATELIMIT_MAP_CAP 🔒

Cap on the number of accounts each bucket table holds.

Statics

ACCOUNT_FULL_WARNING 🔒

FAILED_FULL_WARNING 🔒

Functions

account_key 🔒

One bucket per account regardless of the case it was typed in, matching the lowercase fallback the password check itself applies.

debit_at 🔒

Take one token from an account’s bucket, refusing when none is left.

limit_exceeded 🔒

prune_sample 🔒

Remove, from the next bounded sample of the table, the buckets that have refilled completely.

refill 🔒

refund_at 🔒

Give a held reservation’s token back, never past the burst.

reserve_at 🔒

retry_after 🔒

Seconds until one token is back, rounded up and capped. None when it cannot be stated, which the error then simply omits.

warn_table_full 🔒

Warn that the table for axis cannot admit another account.

Type Aliases

Buckets 🔒

Ratelimiter 🔒