long2ice / fastapi-limiter

A request rate limiter for fastapi
https://github.com/long2ice/fastapi-limiter
Apache License 2.0
487 stars 53 forks source link

Rate-limiter counts the same request more than once when there are multiple rate-limiter rules #40

Closed rbracco closed 1 year ago

rbracco commented 1 year ago
@router.get("/", dependencies=[
    Depends(RateLimiter(times=20, seconds=60)),  # 1 minute
    Depends(RateLimiter(times=200, seconds=10 * 60)),  # 10 minutes
    Depends(RateLimiter(times=1200, seconds=60 * 60)),  # hourly limit
    Depends(RateLimiter(times=5000, seconds=24 * 60 * 60)),  # daily limit)]

My route is only being hit once but each request is being counted as 4 requests by the rate limiter, thus the limit for 1 minute is hit after only 5 requests instead of 20. If I comment out 2 of the rules, it hits the limit after 10 requests. I believe there is a bug leading to each request being counted N times when you have N rules.

My current workaround is to just change the code to...

@router.get("/", dependencies=[
    Depends(RateLimiter(times=4*20, seconds=60)),  # 1 minute
    Depends(RateLimiter(times=4*200, seconds=10 * 60)),  # 10 minutes
    Depends(RateLimiter(times=4*1200, seconds=60 * 60)),  # hourly limit
    Depends(RateLimiter(times=4*5000, seconds=24 * 60 * 60)),  # daily limit)]
rbracco commented 1 year ago

Closing as this was a side-effect of #41