New on the blog: Skip the Plugin — Building a Rate-Limited API in Wheels 4.0. <Full Post> What it covers: • Three rate-limit strategies in the box — fixed window, sliding window, token bucket — and which one to pick • Per-API-key limiting via the

keyFunction

closure (Alice and Bob behind the same office NAT, different buckets) • The

trustProxy

/

proxyStrategy

footgun — why it's off by default and how to read

X-Forwarded-For

safely behind nginx vs ALB vs Cloudflare • Canonical pipeline order: RequestId → SecurityHeaders → Cors → RateLimiter → app, and why 429s still need CORS • In-memory vs database storage, fail-closed default,

wheels_rate_limits

auto-table Side effect of writing the post: a small framework fix (#2693) —

RateLimiter

now throws a typed error at init time when

windowSeconds=0

instead of leaking a div-by-zero out of the strategy math.