upstash/ratelimit deny lists: block IPs, countries, and user agents from the dashboard

# @upstash/ratelimit deny lists: block bad actors from the dashboard

## Enable

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(10, "10 s"),
  enableProtection: true,
  analytics: true,
});

const { success, reason, deniedValue } = await ratelimit.limit("userId", {
  ip: "ip-address",
  userAgent: "user-agent",
  country: "country",
});

A denied request returns success false, reason "denyList", and the
matched value in deniedValue.

## Manage

Deny-list contents live in the Ratelimit dashboard in the Upstash
console. Add or remove IPs, user agents, countries, and identifiers
there. Matching is exact: no wildcards, no patterns.

## The 1-minute cache trap

When a value is denied, the client caches it for a minute and denies
further requests without calling Redis. Consequence: adding a value to
the deny list takes effect immediately, but removing one can take up
to a minute before clients accept it again. Do not page anyone over a
removal that is 30 seconds old.

## Auto IP deny list

With protection on, the SDK can also auto-block IPs from open-source
deny lists (aggregated from 30+ sources). The list refreshes daily at
2AM UTC; the first limit() call after that hour spends 9 commands on
the refresh. Hand the pending promise to waitUntil so the refresh
completes.

## Cost

Deny-list checks add 2 commands per limit call on top of the algorithm
cost.