How to design an API Rate Limiter?

Anjali Sharma answered on January 15, 2023 Popularity 7/10 Helpfulness 1/10

answer How to design an API Rate Limiter?

How to design an API Rate Limiter?

Comment

Using Rate Limiter we can enforce policies as below:

A maximum of 20 accounts are allowed to be created per day from a unique source IP address. This helps minimizing spams or malicious accounts creation, and Denial of Service (DoS) and Distributed Denial of Service (DDoS).

Devices are allowed 5 failed credit card transactions per day.

Users may only send 1 message per day with risky keywords.

public class RateLimitInterceptor implements HandlerInterceptor {

    private PricingPlanService pricingPlanService;

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) 
      throws Exception {
        String apiKey = request.getHeader("X-api-key");
        if (apiKey == null || apiKey.isEmpty()) {
            response.sendError(HttpStatus.BAD_REQUEST.value(), "Missing Header: X-api-key");
            return false;
        }

        Bucket tokenBucket = pricingPlanService.resolveBucket(apiKey);
        ConsumptionProbe probe = tokenBucket.tryConsumeAndReturnRemaining(1);
        if (probe.isConsumed()) {
            response.addHeader("X-Rate-Limit-Remaining", String.valueOf(probe.getRemainingTokens()));
            return true;
        } else {
            long waitForRefill = probe.getNanosToWaitForRefill() / 1_000_000_000;
            response.addHeader("X-Rate-Limit-Retry-After-Seconds", String.valueOf(waitForRefill));
            response.sendError(HttpStatus.TOO_MANY_REQUESTS.value(),
              "You have exhausted your API Request Quota"); 
            return false;
        }
    }
}

https://blog.tryexponent.com/rate-limiter-system-design/

Popularity 7/10 Helpfulness 1/10 Language java

Source: Grepper

Tags: java rate

Link to this answer
Share Copy Link

Contributed on Jan 15 2023

Anjali Sharma

0 Answers Avg Quality 2/10

How to design an API Rate Limiter?

Contents

More Related Answers

How to design an API Rate Limiter?

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.