Gateway Cluster-Wide Auth Rate Limiting

Share brute-force budgets across every gateway replica via a Redis-backed auth rate limiter

Set gateway.push.redis and every replica of your gateway shares one brute-force budget, so max_attempts on login and approval is a cluster-wide total — not a per-replica one.

Quick Start

1. Single replica — nothing to do

   One gateway process already enforces the limits correctly with the in-process AuthRateLimiter.

   import asyncio
   from praisonaiagents import Agent
   from praisonai_bot.gateway import WebSocketGateway
   
   agent = Agent(name="Support", instructions="Help users")
   
   gateway = WebSocketGateway()            # in-process auth limits
   gateway.register_agent(agent)
   asyncio.run(gateway.start())

2. Multiple replicas — set gateway.push.redis

   The auth limiters pick up the gateway’s push Redis automatically. There is no extra knob.

   gateway:
     push:
       redis:
         url: redis://localhost:6379   # reused for auth rate limiting

3. Or wire it in Python

   Pass a RedisConfig on GatewayConfig.push where you construct the gateway.

   import asyncio
   from praisonaiagents import Agent
   from praisonaiagents.gateway import GatewayConfig, PushConfig, RedisConfig
   from praisonai_bot.gateway import WebSocketGateway
   
   agent = Agent(name="Support", instructions="Help users")
   
   gateway = WebSocketGateway(
       config=GatewayConfig(
           push=PushConfig(redis=RedisConfig(url="redis://localhost:6379")),
       ),
   )
   gateway.register_agent(agent)
   asyncio.run(gateway.start())

How It Works

Every attempt runs one atomic Lua script on Redis: check the lockout key, INCR the bucket, set its window TTL, and set a lockout once the budget is exceeded. All replicas hit the same keys, so counts never race.

Covered endpoints

Keys are namespaced as {prefix}authrl:{endpoint}:{identity}:b (bucket) and {prefix}authrl:{endpoint}:{identity}:l (lockout), where {prefix} is push.redis.prefix (default praison:push:). Both expire via Redis TTLs, so nothing needs pruning.

Redis Outage Behaviour

The limiter never fails open. If Redis is unreachable it falls back to a local per-replica limiter, so per-replica limits still apply.

Configuration Options

The limiter reuses the gateway’s push RedisConfig — no separate auth-limiter Redis knob.

Best Practices

Related