Setting Up Rate Limiting in Production

Rate limiting is your first line of defense against API abuse, DDoS attacks, and resource exhaustion. In this comprehensive guide, we will walk through implementing production-grade rate limiting with real-world examples.

Why Rate Limiting Matters

Rate Limiting Algorithms Compared

Multi-Level Rate Limiting Strategy

Production systems need rate limiting at multiple levels. Here is the recommended approach:

Implementation with G8KEPR

G8KEPR provides production-ready rate limiting out of the box. Here is a sample configuration:

# docker-compose.yml
services:
  gatekeeper:
    image: g8kepr/gateway:latest
    environment:
      # Sliding window rate limits
      RATE_LIMIT_PER_IP: "100/1m"
      RATE_LIMIT_PER_USER: "1000/1m"
      RATE_LIMIT_PER_API_KEY: "5000/1m"

      # Endpoint-specific limits
      RATE_LIMIT_LOGIN: "5/5m"        # Prevent brute force
      RATE_LIMIT_SIGNUP: "3/1h"       # Prevent spam accounts
      RATE_LIMIT_EXPORT: "10/1h"      # Expensive operation

      # Redis for distributed counting
      REDIS_URL: "redis://redis:6379"

      # Response headers
      RATE_LIMIT_HEADERS: "true"      # X-RateLimit-* headers
    ports:
      - "8080:8080"

  redis:
    image: redis:7-alpine
    volumes:
      - redis-data:/data

volumes:
  redis-data:

Monitoring and Alerts

Rate limiting is only effective if you monitor it. Set up alerts for:

• Unusual spike in rate limit rejections (possible attack)
• Specific IPs hitting limits repeatedly (block them)
• Legitimate users hitting limits (increase their tier)
• Global limit approaching capacity (scale infrastructure)