Rate Limiter

Edge middleware component that tracks and limits the number of form submission requests per IP address within a rolling time window. Integrated into the Next.js API route to reject excessive requests before they reach business logic, protecting against spam and denial-of-service attacks.

Feature: Booking Form

rate-limiter

• Track submission attempts per IP using an in-memory or Redis-backed store
• Reject requests exceeding the configured threshold with a 429 response
• Reset counters after the rolling window expires