Rate Limiting

Rate Limiting is a rack middleware that rate-limit HTTP requests in many different ways. It provides tools for creating rules which can rate-limit routes separately.

How to use it

Adding to Rails 3.x

Gemfile

 gem 'rate-limiting'

config/application.rb

 require "rate_limiting"

 class Application < Rails::Application

   config.middleware.use RateLimiting do |r|

     # Add your rules here, ex:

     r.define_rule( :match => '/resource', :type => :fixed, :metric => :rph, :limit => 300 )
     r.define_rule(:match => '/html', :limit => 1)
     r.define_rule(:match => '/json', :metric => :rph, :type => :frequency, :limit => 60)
     r.define_rule(:match => '/xml', :metric => :rph, :type => :frequency, :limit => 60)
     r.define_rule(:match => '/token/ip', :limit => 1, :token => :id, :per_ip => true)
     r.define_rule(:match => '/token', :limit => 1, :token => :id, :per_ip => false)
     r.define_rule(:match => '/fixed/rpm', :metric => :rpm, :type => :fixed, :limit => 1)
     r.define_rule(:match => '/fixed/rph', :metric => :rph, :type => :fixed, :limit => 1)
     r.define_rule(:match => '/fixed/rpd', :metric => :rpd, :type => :fixed, :limit => 1)
     r.define_rule(:match => '/freq/rpm', :metric => :rpm, :type => :frequency, :limit => 1)
     r.define_rule(:match => '/freq/rph', :metric => :rph, :type => :frequency, :limit => 60)
     r.define_rule(:match => '/freq/rpd', :metric => :rpd, :type => :frequency, :limit => 1440)
     r.define_rule(:match => '/header', :metric => :rph, :type => :frequency, :limit => 60)

   end

 end

Rule Options

match

Accepts aimed resource path or Regexp like '/resource' or "/resource/.*"

metric

:rpd - Requests per Day

:rph - Requests per Hour

:rpm - Requests per Minute

type

:frequency - 1 request per (time/limit)

:fixed - limit requests per time

Examples:

  r.define_rule(:match => "/resource", :metric => :rph, :type => :frequency, :limit => 3)

  => 1 request every 20 min

  r.define_rule(:match => "/resource", :metric => :rph, :type => :fixed, :limit => 3)

  => 3 request every 60 min

token

:foo - limit by request parameter 'foo'

per_ip

Boolean, true = limit by IP

per_url

Option used when the match option is a Regexp. If true, it will limit every url catch separately.

Example:

r.define_rule(:match => '/resource/.*', :metric => :rph, :type => :fixed, :limit => 1, :per_url => true)

This example will let 1 request per hour for each url caught. ('/resource/url1', '/resource/url2', etc...)

Limit Entry Storage

By default, the record store used to keep track of request matches is a hash stored as a class instance variable in app instance memory. For a distributed or concurrent application, this will not yeild desired results and should be changed to a different store.

Set the cache by calling set_cache in the configuration block

r.set_cache(Rails.cache)

Any traditional store will work, including Memcache, Redis, or an ActiveSupport::Cache::Store. Which is the best choice is an application specific decision, but a fast, shared store is highly recommended.

A more robust cache configuration example:

store = case
when ENV['REDIS_RATE_LIMIT_URL'].present?
  # use a separate redis DB
  Redis.new(url: ENV['REDIS_RATE_LIMIT_URL'])
when ENV['REDIS_PROVIDER'].present?
  # no separate redis DB available, share primary redis DB
  Redis.new(url: ENV[ENV['REDIS_PROVIDER']])
when (redis = Redis.new) && (redis.client.connect rescue false)
  # a standard redis connection on port 6379 is available
  redis
when Rails.application.config.cache_store != :null_store
  # no redis store is available, use the rails cache
  Rails.cache
else
  # no distributed store available,
  # a class instance variable will be used
  nil
end

r.set_cache(store) if store.present?
Rails.logger.debug "=> Rate Limiting Store Configured: #{r.cache}"

Running Tests

bundle exec rspec spec