Chapter 16: Connection Security, Rate Limiting, and Input Boundaries
This chapter describes how rate limiting, blacklists, backpressure, input limits, TLS, authorization, and log redaction work together.
1. Security is not one switch
TLS, connection limiting, write backpressure, header/body limits, worker queue limits, authentication, authorization, and safe logging form a complete defense. Enabling security_open provides a baseline; it does not replace application security.
2. Layered ConnectionLimiter model
- IP level: concurrent connections, connect rate, risk score, temporary blacklist.
- fd level: per-connection request rate and last activity.
- path level: additional limits for endpoints such as
/login.
| Strategy | Behavior | Use |
|---|---|---|
| Cooldown | Requires a quiet period after violation | Brute force and persistent retries |
| FixedWindow | Low overhead, boundary bursts possible | Low-risk simple limits |
| SlidingWindow | Fair over any recent interval | Public HTTP APIs |
| TokenBucket | Allows bursts while limiting average rate | General traffic shaping |
3. Manual example
ConnectionLimiter limiter(20, 60);
limiter.setRequestStrategy(RateLimitType::SlidingWindow);
limiter.setPathStrategy(RateLimitType::Cooldown);
limiter.setPathLimit("/login", 5, 60);
const DefenseDecision d = limiter.allowRequest(ip, fd, "/login", 100, 1);
if(d == DROP)
return;
if(d == CLOSE)
closeConnection(); // The caller performs the actual close.ConnectionLimiter does not contain its own lock. Its intended execution model is a single event-loop thread, or an externally synchronized caller. A registered connection close is paired with clearIP().
4. Server input boundaries
- Maximum HTTP header and body sizes.
- Per-connection pending-write high-water mark.
- Per-event write budget.
- Maximum pending Worker tasks.
- TLS peer verification and private-key permissions.
- Application validation for paths, query values, JSON fields, and uploads.
5. Secrets and logs
Redact Authorization, Cookie, secrets, keys, IVs, private keys, and sensitive request bodies. Secrets are loaded through protected configuration or a secret manager and are not stored in the source repository.