v0.5.0

Changed

• Plugins returning null weren't fully indeterminate: They will now limit the request only if no other limited have passed. As soon as another plugin passes, any subsequent null result will pass (for the current request).

Added

• Added "extra data" type parameter for the rate limiter, so plugins can be provided information outside the request event. See README for an example.

v0.4.3

Changed

• The "rates" object options (IP, IPUA, cookie) should now be set in the top of the configuration for RateLimiter, no need for a nested object.
• Deprecated the ms rate unit, it's not reliable due to OS timing issues.

Added

• Added more units for milliseconds and seconds.

v0.4.2

Fixed

• Compatibility with SvelteKit 2.

v0.4.1

Fixed

• Hash function is now compatible with any environment that supports Web Crypto API, including Cloudflare workers. (Wasn't working properly in 0.4.0)

v0.4.0

Changed

• limiter.preflight is now async and must be awaited!
• Cookie limiter options now takes a serializeOptions, that can be used for customizing the cookie.

Added

• hashFunction option, for custom hashing. Defaults to Web Crypto API SHA-256, will fallback to NodeJS crypto if not available.

Fixed

• Hash function is now compatible any environment that supports Web Crypto API, including Cloudflare workers.

v0.3.5

Added

• Added a RetryAfterRateLimiter, that provides information for setting a Retry-After header.
• Added clear method to the rate limiters.

v0.3.4

Security

• Rate wasn't limited when null was returned last in chain.

Fixed

• Added top-level export, to make vite/vitest satisfied.

v0.3.2

Changed

• Removed check method from RateLimiterStore interface.

Added

• RateLimiterPlugin can now return null, as an indeterminate result.

Fixed

• RateLimiter plugin chain wasn't immutable.