Rate limiting

POST   /admin/identities
GET    /admin/identities
DELETE /admin/identities/{id}
GET    /admin/sessions
...

HTTP/1.1 200 OK
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59
X-RateLimit-Reset: 1640000000

HTTP/1.1 429 Too Many Requests
Retry-After: 42
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1640000042

{
  "error": {
    "id": "rate_limit_exceeded",
    "code": 429,
    "message": "Rate limit exceeded. Please try again in 42 seconds.",
    "reason": "Too many requests"
  }
}

async function makeRequest(url, options = {}) {
  const response = await fetch(url, {
    ...options,
    credentials: 'include'
  });
  
  // Check rate limit headers
  const remaining = parseInt(response.headers.get('X-RateLimit-Remaining'));
  const reset = parseInt(response.headers.get('X-RateLimit-Reset'));
  
  if (response.status === 429) {
    const retryAfter = parseInt(response.headers.get('Retry-After'));
    console.warn(`Rate limited. Retry after ${retryAfter} seconds`);
    
    // Wait and retry
    await new Promise(resolve => setTimeout(resolve, retryAfter * 1000));
    return makeRequest(url, options);
  }
  
  // Warn when approaching limit
  if (remaining < 5) {
    console.warn(`Approaching rate limit. ${remaining} requests remaining`);
  }
  
  return response;
}

// Usage
const response = await makeRequest('/self-service/login/browser');

async function fetchWithRetry(url, options = {}, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    const response = await fetch(url, options);
    
    if (response.status !== 429) {
      return response;
    }
    
    // Exponential backoff: 2^i seconds
    const delay = Math.pow(2, i) * 1000;
    console.log(`Rate limited. Retrying in ${delay/1000}s...`);
    await new Promise(resolve => setTimeout(resolve, delay));
  }
  
  throw new Error('Max retries exceeded');
}

selfservice:
  flows:
    login:
      after:
        password:
          hooks:
            - hook: revoke_active_sessions

// Detect rate limit and show CAPTCHA
if (response.status === 429 || failedAttempts > 3) {
  await showCaptcha();
}

# Prometheus metrics (if enabled)
kratos_http_requests_total{status="429"}
kratos_http_request_duration_seconds{status="429"}

# Example Prometheus alert
groups:
  - name: kratos_security
    rules:
      - alert: HighRateLimitHitRate
        expr: rate(kratos_http_requests_total{status="429"}[5m]) > 10
        for: 5m
        annotations:
          summary: "High rate limit hit rate detected"
          description: "{{ $value }} rate limit errors per second"

# Find IPs hitting rate limits
grep '"status":429' kratos.log | jq -r '.remote_addr' | sort | uniq -c | sort -rn

# Top rate-limited endpoints
grep '"status":429' kratos.log | jq -r '.path' | sort | uniq -c | sort -rn

geo $limit {
    default 1;
    10.0.0.0/8 0;      # Internal network
    203.0.113.0/24 0;  # Office IP range
}

map $limit $limit_key {
    0 "";
    1 $binary_remote_addr;
}

limit_req_zone $limit_key zone=kratos:10m rate=10r/s;