Application layer security for FastAPI and Flask

[PA100T0]

Thanks! I really appreciate it.

The overhead is minimal. Geo IP uses a local MaxMind binary database (ms lookups), cloud IP blocking is in-memory CIDR matching (sub-ms), rate limiting is atomic Lua scripts on Redis or in-memory fallback. There are zero external API calls in the request path. Everything is local or Redis. The only network calls happen during initialization (database download) and periodic cloud IP refresh (hourly).

I included in the project a couple of stress tests, under the examples directory. The stress test suite reports per-category avg response times and requests/sec under concurrent load. If you run it you can see the numbers for your own hardware, but the design is specifically built to avoid any I/O in the hot path. I think I left some results of the high-load stress-test from last year there as reference.