net/http & Chi

distlimit provides a standard func(http.Handler) http.Handler middleware adapter via github.com/balramadan/distlimit/middleware/nethttp. Compatible with standard http.ServeMux, Chi, Gorilla/Mux, and Go 1.22+ HTTP routing.

---

Installation

Install distlimit using Go Modules:

go get github.com/balramadan/distlimit

---

Basic Setup

Attach distlimit middleware to standard HTTP handlers or Chi routers:

package main

import (
  "net/http"
  "time"

  "github.com/balramadan/distlimit"
  "github.com/balramadan/distlimit/algorithm/tokenbucket"
  "github.com/balramadan/distlimit/driver/memory"
  distlimitnethttp "github.com/balramadan/distlimit/middleware/nethttp"
)

func main() {
  // 1. Initialize Driver & Limiter (100 requests / minute)
  memDriver := memory.New(5 * time.Minute)
  limiter, _ := distlimit.New(
    memDriver,
    distlimit.WithLimit(100),
    distlimit.WithWindow(1*time.Minute),
    distlimit.WithAlgorithm(tokenbucket.New()),
  )

  mux := http.NewServeMux()

  apiHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
    w.Write([]byte("pong"))
  })

  // 2. Wrap Handler with distlimit Middleware
  middleware := distlimitnethttp.New(limiter)
  mux.Handle("/api/ping", middleware(apiHandler))

  http.ListenAndServe(":8080", mux)
}

---

Configuration Options

Configure the middleware behavior by passing options into distlimitnethttp.New(limiter, opts...):

Option	Type	Description
WithTrustedProxies(proxies)	[]string	CIDR blocks or IPs of trusted reverse proxies for secure IP parsing.
WithKeyFunc(fn)	func(ctx context.Context) string	Custom function to extract rate limit key from request context.
WithRouteLabeling(enable)	bool	Enables passing HTTP route path (r.Pattern / r.URL.Path) into metric labels.

---

Custom Key Extraction Example

By default, distlimit rate limits requests based on client IP addresses. You can extract custom identifiers like API Keys or Bearer Tokens using WithKeyFunc:

middleware := distlimitnethttp.New(
  limiter,
  distlimitnethttp.WithKeyFunc(func(ctx context.Context) string {
    // Custom key logic using context or custom values
    return "global_rate_key"
  }),
)

---

Response Headers & Error Behavior

When rate limiting is enforced, distlimit automatically injects standard RFC 6585 and legacy rate-limit headers into every HTTP response:

Header	Description	Example
RateLimit-Limit	Configured maximum request quota in current window	100
RateLimit-Remaining	Remaining allowed requests in current window	99
RateLimit-Reset	Time in seconds until request quota resets	45
X-RateLimit-Limit	Legacy header for maximum request limit	100
X-RateLimit-Remaining	Legacy header for remaining request quota	99
X-RateLimit-Reset	Legacy header for reset duration in seconds	45

When a client exceeds the allowed quota, the handler execution halts and returns HTTP status 429 Too Many Requests.