How to implement rate limiting on an OAuth protected REST api?

Question

Are there any best practices for implementing rate limiting for an OAuth2 protected api?

I realise that REDIS is often used for this, but since I'm using a db to persist the tokens, I was thinking of using that for rate limiting as well. It would store the maximum number of queries for each token and decrement that each time the token is used and then reset the counter daily or hourly.

Any major problems with that approach?

José F. Romaniello · Accepted Answer · 2015-04-19 14:05:24Z

3

The most common algorithm used for this is Token Bucket.

You can put the logic in your app and use redis or other db as a backend. Redis is particularly interesting for this because you can use things like TTL.

I have been working on another approach moving all the logic to a daemon. I don't have clients in other technologies than node.js yet but you can check the idea here.

answered Apr 19, 2015 at 14:05

José F. Romaniello

14.2k3 gold badges38 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to implement rate limiting on an OAuth protected REST api?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related