Implement Rate Limiting

[dotStart]

Adds support for rate limiting on especially vulnerable endpoints.

Behavior

When a client exceeds the maximum permitted amount of requests for a given endpoint, a 429 Too Many Requests will be returned. Additionally a set of headers is added to responses for affected endpoints:

Header	Type	Description
X-RateLimit-Limit	u32	Total number of permitted requests in a given window
X-RateLimit-Remaining	u32	Remaining number of permitted requests in current window
X-RateLimit-NearLimit	bool	Set if 25% or less of total permitted requests remain
X-RateLimit-RetryAfter	u64	Time (in seconds) until requests are permitted again

A new permission called BypassRateLimit is added which allows certain users to exceed the new limitations. By default, this permission is set on the initial user created within the internal user authentication system. When no authentication system is in used, all requests are limited.

Affected Endpoints

• POST v1/auth/login - 8 request burst, regains 1 per 10 minutes by default
• POST v1/document - 10 per hour
• GET v1/document/:id - 30 per hour