application.properties

#bloqueio dos endpoints de autenticação - /auth
bucket4j.filters[0].cache-name=rate-limit
bucket4j.filters[0].http-response-body={ "message": "Too many requests" }
bucket4j.filters[0].url=/auth/.*   #url que será impactada pela regra
bucket4j.filters[0].rate-limits[0].expression=@authService.getCurrentAuthUserInSession()   #chave da regra de bloqueio. Retornado o usuário da sessão
bucket4j.filters[0].rate-limits[0].bandwidths[0].capacity=3   #3 requisições permitidas no intervalod de 1 minuto
bucket4j.filters[0].rate-limits[0].bandwidths[0].time=1
bucket4j.filters[0].rate-limits[0].bandwidths[0].unit=minutes
bucket4j.filters[0].rate-limits[0].bandwidths[0].fixed-refill-interval=5   #ao exceder, será bloqueado por 5 minutos
bucket4j.filters[0].rate-limits[0].bandwidths[0].fixed-refill-interval-unit=minutes

#bloqueio para todos os endpoints, exceto das urls iniciadas '/actuator'
bucket4j.filters[1].cache-name=${bucket4j.filters[0].cache-name}
bucket4j.filters[1].http-response-body=${bucket4j.filters[0].http-response-body}
bucket4j.filters[1].url=.*
bucket4j.filters[1].rate-limits[0].skip-condition=getRequestURI().contains('/actuator')
bucket4j.filters[1].rate-limits[0].expression=getRemoteAddr()
bucket4j.filters[1].rate-limits[0].bandwidths[0].capacity=5
bucket4j.filters[1].rate-limits[0].bandwidths[0].time=1
bucket4j.filters[1].rate-limits[0].bandwidths[0].unit=minutes
bucket4j.filters[1].rate-limits[0].bandwidths[0].fixed-refill-interval=1
bucket4j.filters[1].rate-limits[0].bandwidths[0].fixed-refill-interval-unit=minutes