Allows limiter headers to be written via setting instead of sending them at all times

[go-aegian]

The headers output by this middleware "X-RateLimit-Limit", "X-RateLimit-Remaining", "X-RateLimit-Reset", "Retry-After" should be output depending on a configuration for it.

[micronull]

These headings are common practice. You'd rather have an option to turn them off.

[mwodrich]

+1 for a configuration option to disable adding X-RateLimit-* headers and Retry-After header, as users may wish to only respond with these under certain circumstances.

[pkieltyka]

Sorry but I don’t understand the request of this ticket.

[mwodrich]

These headers are very useful for coordinating rates with a cooperative client that just needs to bound resource usage over time, but in a scenario where the rate limits are set to limit the impact of malicious actors, I don't believe it is valuable or appropriate to give them any information about the state or configuration of the rate limiter.

[benstigsen]

... but in a scenario where the rate limits are set to limit the impact of malicious actors, I don't believe it is valuable or appropriate to give them any information about the state or configuration of the rate limiter.

I agree with this.

[VojtechVitek]

These headers are a de-facto standard for rate-limiting (see https://www.ietf.org/archive/id/draft-ietf-httpapi-ratelimit-headers-07.html draft). Let's keep them as is.

https://github.com/go-chi/httprate/blob/3327e65758bd2f38762b8e8760040d77ebf5f919/limiter.go#L99-L101

If you need to remove the headers for some reason, you can write a middleware that explicitly removes the response headers. Something like

func RemoveHeadersMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// Unset headers set by previous middleware before handler writes to response body.
		w.Header().Del("X-RateLimit-Limit")
		w.Header().Del("X-RateLimit-Remaining")
		w.Header().Del("X-RateLimit-Reset")

		next.ServeHTTP(w, r)
	})
}

[VojtechVitek]

I've just noticed this unlinked PR: https://github.com/go-chi/httprate/pull/16. Reopening.

[VojtechVitek]

Implemented in https://github.com/go-chi/httprate/pull/31.

You can now omit all headers via:

httprate.Limit(
	1000,
	time.Minute,
	httprate.WithResponseHeaders(httprate.ResponseHeaders{}),
)

You can also customize or omit individual headers:

httprate.Limit(
            1000,
            time.Minute,
            httprate.WithResponseHeaders(httprate.ResponseHeaders{
                    Limit:      "", // omit
                    Remaining:  "", // omit
                    Increment:  "", // omit
                    Reset:      "X-RateLimit-Reset",
                    RetryAfter: "Retry-After",
            }),
    )