如何在龙卷风 python 应用程序上添加速率限制

Question

would it be possible to implement a rate limiting feature on my tornado app? like limit the number of HTTP request from a specific client if they are identified to send too many requests per second (which red flags them as bots).

I think I could it manually by storing the requests on a database and analyzing the requests per IP address but I was just checking if there is already an existing solution for this feature.

I tried checking the github page of tornado, I have the same questions as this post but no explicit answer was provided. checked tornado's wiki links as well but I think rate limiting is not handled yet.

Answer 1

Instead of storing them in the DB, would be better to have them in a dictionary stored in memory for easy usability. Also can you share the details whether the api has a load-balancer and which web-server is used.

Answer 2

The enterprise grade solution to your problem is ambassador . You can use ambassador's solutions like envoy proxy and edge stack and have it set up that can do the needful.

additional to tore the data, you can use any popular cached db, or d that store as key:value pairs, for example redis.

if you doing this for a very small project, can use some npm/pip packages.

Read the docs: https://www.getambassador.io/products/edge-stack/api-gateway/

Answer 3

You should probably do this before your requests reach Tornado.

But if it's an application level feature (limiting requests depending on level of subscription), then you can do it in Tornado in lots of ways, depending on how complex you want the rate limiting to be.

Probably the simplest way is to have a dict on your tornado.web.Application that uses the ip as the key and the timestamp of the last request as the value and check every request against it in prepare - if not enough time passed since last request, raise a tornado.web.HTTPError(429) (ideally with a Retry-After header). If you do this, you will still need to clean up this dict now and then to remove entries that have not made a request recently or it will grow (you could do it finish on every request).

If you have another fast/in-memory storage attached (memcache, redis, sqlite), you should use that, but you definitely should not use an RDBMS as all those writes will not be great for its performance.