Rate Limiting Strategies for Auth APIs

Introduction

Authentication and Identity Infrastructure (AI) systems are critical for securing applications. One of the challenges in AI systems is managing the volume of requests, especially when dealing with user authentication and authorization. Rate limiting is a technique used to control the number of requests a client can make within a specific time frame. This blog post explores various rate limiting strategies, including per-IP, per-user, per-endpoint, and per-tenant rate limiting, with specific implementations using token bucket and sliding window algorithms.

Per-IP Rate Limiting

Per-IP rate limiting ensures that each IP address has a limited number of requests per unit of time. This is particularly useful in scenarios where a single IP address might be used by multiple users, and you want to prevent abuse.

Token Bucket Implementation

The token bucket algorithm is a simple and effective way to implement per-IP rate limiting. The algorithm maintains a token bucket that fills up at a constant rate and drains at a variable rate based on the number of requests. If the bucket is empty, the request is denied.

          // TokenBucket implementation in Python
          import time
      
          class TokenBucket:
              def __init__(self, capacity, refill_rate):
                  self.capacity = capacity
                  self.tokens = capacity
                  self.refill_rate = refill_rate
                  self.last_refill = time.time()
      
              def refill(self):
                  now = time.time()
                  elapsed = now - self.last_refill
                  self.tokens = min(self.capacity, self.tokens + elapsed * self.refill_rate)
                  self.last_refill = now
      
              def consume(self, tokens):
                  self.refill()
                  if self.tokens >= tokens:
                      self.tokens -= tokens
                      return True
                  return False
          

Per-User Rate Limiting

Per-User rate limiting ensures that each user has a limited number of requests per unit of time. This is useful in scenarios where you want to prevent abuse of a single user's account.

Sliding Window Implementation

The sliding window algorithm maintains a sliding window of requests over a specified time frame and counts the number of requests within that window. If the count exceeds the limit, the request is denied.

          // SlidingWindow implementation in Python
          class SlidingWindow:
              def __init__(self, window_size, limit):
                  self.window_size = window_size
                  self.limit = limit
                  self.requests = []
      
              def add_request(self):
                  self.requests.append(time.time())
      
              def is_within_limit(self):
                  self.requests = [req for req in self.requests if req >= time.time() - self.window_size]
                  return len(self.requests) <= self.limit
          

Per-Endpoint Rate Limiting

Per-Endpoint rate limiting ensures that each endpoint has a limited number of requests per unit of time. This is useful in scenarios where you want to prevent abuse of a specific endpoint.

Token Bucket Implementation

The token bucket algorithm can also be used to implement per-endpoint rate limiting. Each endpoint has its own token bucket, and requests are processed based on their respective bucket.

Per-Tenant Rate Limiting

Per-Tenant rate limiting ensures that each tenant has a limited number of requests per unit of time. This is useful in scenarios where you want to manage resources for different tenants in a unified system.

Sliding Window Implementation

The sliding window algorithm can also be used to implement per-tenant rate limiting. Each tenant has its own sliding window, and requests are processed based on their respective window.

Integrating Rate Limiting with Bastionary

Bastionary is a self-hosted platform that provides authentication, billing, licensing, and feature flags. Bastionary's rate limiting system can be integrated with rate limiting strategies like token bucket and sliding window to ensure that the system remains secure and scalable.