CODEWITHSUNDEEP
spring-securityspring-security-oauth2rate-limiting
wannabeartist
wannabeartist

Reputation: 2833

How to implement rate limiting on an OAuth protected REST api?

Are there any best practices for implementing rate limiting for an OAuth2 protected api?

I realise that REDIS is often used for this, but since I'm using a db to persist the tokens, I was thinking of using that for rate limiting as well. It would store the maximum number of queries for each token and decrement that each time the token is used and then reset the counter daily or hourly.

Any major problems with that approach?

Upvotes: 2

Views: 1720

Answers (1)

José F. Romaniello
José F. Romaniello

Reputation: 14156

The most common algorithm used for this is Token Bucket.

You can put the logic in your app and use redis or other db as a backend. Redis is particularly interesting for this because you can use things like TTL.

I have been working on another approach moving all the logic to a daemon. I don't have clients in other technologies than node.js yet but you can check the idea here.

Upvotes: 3

Related Questions