Implementing API Rate Limiting in Spring Boot Applications

Java, Spring, Spring Boot

As APIs gain popularity, implementing rate limiting becomes essential to protect your services from abuse and ensure fair usage among clients. Rate limiting controls how often a user can make API requests, preventing issues like Denial of Service (DoS) attacks and server overloads. In this post, we will explore how to implement API rate limiting in a Spring Boot application.

What is Rate Limiting?

Rate limiting is a technique used to control the number of requests a user can make to an API within a specified time frame. By setting limits, you can:

  • Prevent abuse: Avoid excessive usage of server resources.
  • Ensure availability: Maintain performance and availability for all users.
  • Protect against DoS attacks: Mitigate the risk of attacks that aim to overwhelm your service.

Choosing a Rate Limiting Strategy

Several strategies exist for implementing rate limiting, including:

  • Fixed Window: Limits the number of requests in a fixed time interval.
  • Sliding Window: Similar to fixed window, but allows for a more continuous flow of requests.
  • Token Bucket: Allows for bursts of requests while maintaining average limits over time.
  • Leaky Bucket: Processes requests at a steady rate, limiting the burst of incoming requests.

Integrating a Rate Limiting Solution in Spring Boot

To implement rate limiting, you can use different approaches. Here, we’ll explore using a simple implementation with a custom filter as well as integrating a library like Bucket4j.

1. Using a Custom Filter for Rate Limiting

Create a custom filter that extends OncePerRequestFilter. This filter will intercept requests and determine if the rate limit has been exceeded:

import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

@Component
public class RateLimitingFilter extends OncePerRequestFilter {
    private final Map<String, Integer> requestCounts = new HashMap<>();
    private static final int MAX_REQUESTS_PER_MINUTE = 5;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        String userIp = request.getRemoteAddr();
        requestCounts.putIfAbsent(userIp, 0);

        if (requestCounts.get(userIp) >= MAX_REQUESTS_PER_MINUTE) {
            response.setStatus(HttpServletResponse.SC_TOO_MANY_REQUESTS);
            return;
        }

        requestCounts.put(userIp, requestCounts.get(userIp) + 1);
        filterChain.doFilter(request, response);
        // Optionally add logic to reset counts after a time interval
    }
}

This filter will limit the requests based on the user’s IP address and increment a count whenever they access the API.

2. Integrating Bucket4j for Advanced Rate Limiting

For a more sophisticated approach, consider using Bucket4j, which offers a token bucket algorithm for rate limiting.

First, add the Bucket4j dependency to your pom.xml:

<dependency>
    <groupId>net.jemss</groupId>
    <artifactId>bucket4j-core</artifactId>
    <version>7.3.0</version>
</dependency>

Next, create a configuration class for rate limiting:

import net.jemss.bucket4j.Bucket;
import net.jemss.bucket4j.Bucket4J;
import net.jemss.bucket4j.TimeUnit;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.concurrent.TimeUnit;

public class Bucket4jRateLimiter extends OncePerRequestFilter {

    private final Bucket bucket = Bucket4J.builder()
            .addLimit(Bandwidth.simple(5, Duration.ofMinutes(1)))
            .build();

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        if (bucket.tryConsume(1)) {
            filterChain.doFilter(request, response);
        } else {
            response.setStatus(HttpServletResponse.SC_TOO_MANY_REQUESTS);
        }
    }
}

3. Testing Rate Limiting

Run your Spring Boot application and make several requests to your API endpoint. If you exceed the defined rate limit, you should receive a 429 Too Many Requests status code:

curl -X GET http://localhost:8080/api/example

Conclusion

Implementing API rate limiting in Spring Boot applications is crucial for preventing abuse and ensuring reliable service for all users. Whether you choose to implement a simple custom filter or utilize a robust library like Bucket4j, effective rate limiting can help you manage user requests cleanly and efficiently.

For further insights and guidance on advanced topics in Spring Boot, explore the vast learning resources provided by ITER Academy to deepen your understanding of application development.

To learn more about ITER Academy, visit our website.

Explore More

Scroll to Top