search

devondragon / SpringUserFramework

Easy User Management Framework/Starter App for Spring. Providing registration, login, logout, and more built on top of Spring Security.
Apache License 2.0
88 stars 28 forks source link

Add a rate limiting solution #57

Closed devondragon closed 1 year ago

devondragon commented 1 year ago

I would like to have an easy to configure rate limiting solution, which allows for resource specific IP based rate limiting. For this framework it will probably just use an in-memory counter, but should be easily extensible for cluster-level management (via Redis, etc...).

devondragon commented 1 year ago

Having done some research, I think the best course here is to recommend the use of Bucket4J and the Bucket4J Spring Boot Starter.

There's a decent guide here: https://www.baeldung.com/spring-bucket4j

Essentially, using the Bucket4J Spring Boot Starter, you can use yaml configuration to setup complex rate limiting rules for specific URI resources, keying off of things like IP address, username (if authenticated), API-Keys in request headers, and much more, using SPEL syntax. Bucket4J also integrates with various caches and cluster aware solutions. This seems like the perfect solution for this need.