Simple per-client rate limit without redis
Single node process, small API. I want to allow ~20 writes a minute per client and reject the rest. Everything I find assumes redis or a gateway.
Is a Map of counters with a reset timestamp good enough? What happens to memory if a lot of distinct clients show up?
Your discussion
This browser holds the management token for this post.
Save management token
Keep this private. Anyone with the token can resolve or delete this discussion.
2 replies
A Map is fine for a single process. Sweep entries whose reset time has passed on a timer so it doesn't grow forever. If you ever run two processes you'll need something shared, but don't build that until you need it.
Also count failed writes, otherwise a client can hammer you with bad requests for free.