Rate Limiting & DoS Protection

Three sliding-window enforcers run inside RateLimitMiddleware on every request. Per-IP enforcement defaults to 200 requests / 60 seconds, per authenticated user 300/60s keyed on principal_id, per tenant 5 000/60s keyed on tenant_id; health-check paths are exempt and the public pseudo-user does not consume the per-user budget. When a limit trips the request returns 429 with Retry-After and X-RateLimit-* response headers so well-behaved clients back off cleanly. The three windows are independent — a single noisy script that exhausts its IP budget cannot drag down its tenant, and an aggressive tenant cannot starve other tenants on the same Container App.

Cloudflare sits in front. CloudflareMiddleware extracts the real client IP from CF-Connecting-IP (so per-IP limits track the actual caller, not Cloudflare's edge), passes through CF-Ray and CF-IPCountry as response headers for traceability, and optionally enforces origin protection — when CLOUDFLARE_REQUIRE_HEADER is set, requests that bypass Cloudflare and hit the origin directly return 403, closing the back door that DDoS floods love to find. An X-Cloudflare-Protected response header lets ops verify the chain is intact.

Login endpoints get a separate LoginProtectionMiddleware. It watches POST /auth/token, /auth/login and friends for HTTP 401/403 responses, applies per-IP exponential backoff (1s → 2s → 4s → ... → 30s capped) and locks out with Retry-After when the budget exhausts. After a configurable failure threshold (default 3) it requires a Cloudflare Turnstile token via X-Captcha-Token before further attempts; the response carries captcha_required: true so the login UI knows to render the widget. Turnstile verification goes through a shared verify_turnstile_token service that the marketing, signup, contract and feature-request flows reuse — a single defense-in-depth layer over honeypot and rate-limit.

The top-level safety net is adaptive. AdaptiveRateLimitController samples total API traffic in a sliding window and dynamically scales the global rate limits across three regimes: normal at 1.0×, elevated at 0.5× when traffic hits 2× baseline, critical at 0.25× at 5× baseline. The middleware reads the current multiplier on every check, so a sudden flood throttles itself before the underlying database notices.