feat(gateway): add websocket ingress rate limiting

2026-02-15 21:56:13 -08:00
parent 948d589ac3
commit 63d645bd87
10 changed files with 249 additions and 0 deletions
@@ -686,6 +686,20 @@ server:

 The web UI detects the locked state and disables auto-reconnect when rejected.

+## Gateway WebSocket Rate Limit
+
+Per-connection ingress throttling for WebSocket requests. Excess bursts are rejected; repeated violations close the connection (`4008`).
+
+```yaml
+server:
+  ws_rate_limit:
+    enabled: true
+    capacity: 30
+    refill_per_sec: 15
+    max_violations: 8
+    violation_window_ms: 10000
+```
+
 ## Gateway Request Body Limit

 Cap inbound HTTP POST body size (webhooks and Gmail push) to reduce memory-DoS risk.