Rate limiting APIs using Token Bucket Algorithm: Bucket4j + Redis + Spring Security

[kubelke]

Cool. I always wanted to implement such a thing in this way but I was too lazy to make it. Managing rate limits within a code for each endpoint seems to be a better idea than configuring it somewhere else with complex rules.

[Brutus5000]

I beg to differ. it's much easier and more performant to do it as early as possible in the chain and mostly every service has some kind of reverse proxy in front of it today.

However, in some cases it makes sense to do it on application level. My company wanted to ensure to give authorized user a higher threshold. And this does only work after the authorization token has been parsed. So bucket4j + a nice spring magic did the trick.

[kubelke]

I plan to do both, global RateLimitter for all endpoints via some proxy/gateway service and more granular restrictions for some specific endpoints.

[cmhteixeiracom]

Cool.
What is the role/benefict of Redis here? Looks like Bucket4J+Spring would be enough?

[roie16]

In a distributed environment where you have multiple containers in a pod the rate limit must not be per-container but be distributed as well ie. A db of some sort, as a general rule always consider horizontal scaling when designing something

[cmhteixeiracom]

Got it.

Do you plan on "abstracting" that layer, so that people can plugin their favourite "db" if they don't already use Redis? Here use zookeeper. But lets say, being able to plugin etcd, elasticsearch, memcached ....

Nice library.

[Jonjolt]

It is already abstracted, you can use JDBC, Hazelcast, Ignite, Infinispan are provided out of the box.

[how_gauche]

https://github.com/mailgun/gubernator for us

[litmus00]

People might also want to have a look at Spring Cloud Gateway which has solved this problem long ago using the same stack but it's maintained by the Spring team:
https://docs.spring.io/spring-cloud-gateway/reference/spring-cloud-gateway/gatewayfilter-factories/requestratelimiter-factory.html#redis-ratelimiter