Apply Rate Limiting to APIs

Applying rate limiting controls the number of requests sent to your API backend. This protects your backend from too much traffic, both wanted and unwanted (web crawlers, DDoS attacks), which can result in operational inefficiencies and higher costs.

This guide walks you through applying rate limits to control the requests sent to your upstream nodes over time.

Prerequisites

1. Install API7 Enterprise.
2. Have a running API on the gateway group.

Apply Rate Limiting for All Services (Not Recommended)

You should not configure rate-limiting plugins globally, as different APIs typically require different rate-limiting quotas. If you configure the same plugin globally (in a global rule) and locally (in a route), the API7 Gateway executes both plugin instances sequentially.

Apply Rate Limiting for a Single Route

Limit Request Count

This section configures a route with rate limiting to only allow 3 requests in 60 seconds. When the limit is exceeded, a 429 status code is returned to the consumer.

Dashboard

1. Select Published Services of your gateway group from the side navigation bar, then click the service you want to modify, for example, httpbin with version 1.0.0.
2. Under the published service, select Routes from the side navigation bar.
3. Select your target route, for example, get-ip.
4. In the Plugin field, click Enable Plugin.
5. Search for the Limit Count Plugin, then click Enable.
6. In the dialog box, do the following：

• Add the following configuration to the JSON Editor:

  {
    "count": 3,
    "time_window": 60,
    "key_type": "var",
    "rejected_code": 429,
    "rejected_msg": "Too many requests",
    "key": "remote_addr",
    "policy": "local",
    "allow_degradation": false,
    "show_limit_quota_header": true
  }

• Click Enable.

Below is an interactive demo that provides a hands-on introduction to limiting request numbers. You will gain a better understanding of how to use it in API7 Enterprise by clicking and following the steps.

ADC

To use ADC to configure the route, create the following configuration:

adc.yaml

services:
  - name: httpbin
    upstream:
      name: default
      scheme: http
      nodes:
        - host: httpbin.org
          port: 80
          weight: 100
    routes:
      - uris:
          - /ip
        name: get-ip
        methods:
          - GET
        plugins:
          limit-count:
            _meta:
              disable: false
            allow_degradation: false
            count: 3
            key: remote_addr
            key_type: var
            policy: local
            rejected_code: 429
            rejected_msg: Too many requests
            show_limit_quota_header: true
            time_window: 60

Synchronize the configuration to API7 Enterprise:

adc sync -f adc.yaml

Ingress Controller

Create a Kubernetes manifest file for a route, where limit-count is enabled:

httpbin-route.yaml

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: httpbin
  # namespace: api7    # replace with your namespace
spec:
  http:
    - name: get-ip
      match:
        paths:
          - /ip
        methods:
          - GET
      backends:
        - serviceName: httpbin
          servicePort: 80
      plugins:
        - name: limit-count
          enable: true 
          config:
            time_window: 60
            count: 3
            rejected_code: 429

Apply the configurations to your cluster:

kubectl apply -f httpbin-route.yaml

Validate

To validate, send five consecutive requests :

resp=$(seq 5 | xargs -I{} curl "http://127.0.0.1:9080/ip" -o /dev/null -s -w "%{http_code}\n") && \
  count_200=$(echo "$resp" | grep "200" | wc -l) && \
  count_429=$(echo "$resp" | grep "429" | wc -l) && \
  echo "200": $count_200, "429": $count_429

You should see the following response, showing that out of the 5 requests, 3 requests were successful (status code 200) while the others were rejected (status code 429).

200:    3, 429:    2

Limit Requests per Second

This section configures a route with rate-limiting to only allow 1 request per second. When the number of requests per second is between 1 and 3 they will be delayed/throttled. When the number of requests per second is more than 3, a 429 status code is returned.

Dashboard

1. Select Published Services of your gateway group from the side navigation bar, then select the service you want to modify, for example, httpbin with version 1.0.0.
2. Under the published service, select Routes from the side navigation bar.
3. Select your target route, for example, get-ip.
4. In the Plugin field, click Enable Plugin.
5. Search for the Limit Req Plugin, then click Enable.
6. In the dialog box, do the following:

• Add the following configuration to the JSON Editor:

  {
    "rate": 1,
    "burst": 2,
    "rejected_code": 429,
    "key_type": "var",
    "key": "remote_addr",
    "rejected_msg": "Requests are too frequent, please try again later."
  }

• Click Enable.

ADC

To use ADC to configure the route, create the following configuration:

adc.yaml

services:
  - name: httpbin
    upstream:
      name: default
      scheme: http
      nodes:
        - host: httpbin.org
          port: 80
          weight: 100
    routes:
      - uris:
          - /ip
        name: get-ip
        methods:
          - GET
        plugins:
          limit-req:
            _meta:
              disable: false
            burst: 2
            key: remote_addr
            key_type: var
            rate: 1
            rejected_code: 429
            rejected_msg: Requests are too frequent, please try again later.

Synchronize the configuration to API7 Gateway:

adc sync -f adc.yaml

Ingress Controller

Create a Kubernetes manifest file for a route, where limit-req is enabled:

httpbin-route.yaml

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: httpbin
  # namespace: api7    # replace with your namespace
spec:
  http:
    - name: get-ip
      match:
        paths:
          - /ip
        methods:
          - GET
      backends:
        - serviceName: httpbin
          servicePort: 80
      plugins:
        - name: limit-req
          enable: true 
          config:
            burst: 2
            key: remote_addr
            key_type: var
            rate: 1
            rejected_code: 429
            rejected_msg: Requests are too frequent, please try again later.

Apply the configurations to your cluster:

kubectl apply -f httpbin-route.yaml

Validate

To validate, send five requests to the route:

for i in {1..5}; do curl -i '127.0.0.1:9080/ip';  done 

You will get back the required response because the requests are sequential. Now send five concurrent requests to the route:

curl -i "http://127.0.0.1:9080/ip" & \
curl -i "http://127.0.0.1:9080/ip" & \
curl -i "http://127.0.0.1:9080/ip" & \
curl -i "http://127.0.0.1:9080/ip" & \
curl -i "http://127.0.0.1:9080/ip"   

Three of these requests will have the required response, and the other two will be rejected with the following response:

HTTP/1.1 429 Too Many Requests
Date: Fri, 01 Jun 2024 04:43:51 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: API7/3.2.13.0

{"error_msg":"Requests are too frequent, please try again later."}

Rate Limit with Consumers

The following example demonstrates how you can configure different rate limiting policies by consumers. While this example uses Key Auth Plugin for authentication, the route can also be configured with Basic Auth Plugin, JWT Auth Plugin, and HMAC Auth Plugin.

Add a Consumer

Create a regular consumer Alice with key authentication credential, and configure the Limit Count Plugin to allow for a quota of 3 within a 60-second window:

Dashboard

1. Select Consumers of your gateway group from the side navigation bar.
2. Click Add Consumer.
3. From the dialog box, do the following:

• In the Name field, enter Alice.
• Click Add.

4. Under the Credentials tab, click Add Key Authentication Credential.
5. From the dialog box, do the following:

• In the Name field, enter primary-key.
• In the Key field, choose Manually Input, then enter alice-primary-key.
• Click Add.

6. Got to the Plugins tab, click Enable Plugin.
7. Search for the Limit Req Plugin, then click Enable.
8. In the dialog box, do the following:

• Add the following configuration to the JSON Editor:

  {
    "count": 3,
    "time_window": 60,
    "key_type": "var",
    "rejected_code": 429,
    "rejected_msg": "Too many requests",
    "key": "remote_addr",
    "policy": "local",
    "allow_degradation": false,
    "show_limit_quota_header": true
  }

• Click Enable.

ADC

Coming soon.

Ingress Controller

Create a Kubernetes manifest file to configure a consumer alice using the ApisixConsumer custom resource:

consumer.yaml

apiVersion: apisix.apache.org/v2
kind: ApisixConsumer
metadata:
  name: alice
  namespace: api7   # replace with your namespace
spec:
  authParameter:
    keyAuth:
      value:
        key: "alice-key"

Ingress Controller currently does not support ApisixService resource.

To configure the limit-req plugin on a route, update your Kubernetes manifest file of the route as such:

httpbin-route.yaml

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: httpbin
  # namespace: api7    # replace with your namespace
spec:
  http:
    - name: get-ip
      match:
        paths:
          - /ip
        methods:
          - GET
      backends:
        - serviceName: httpbin
          servicePort: 80
      plugins:
        - name: limit-req
          enable: true 
          config:
            time_window: 60
            count: 3
            key_type: var
            rejected_code: 429
            rejected_msg: Too many requests
            key: remote_addr
            policy: local
            allow_degradation: false
            show_limit_quota_header: true

Apply the configurations to your cluster:

kubectl apply -f consumer.yaml -f httpbin-route.yaml

Configure Route

Create a route and configure the Key Auth Plugin for authentication:

Dashboard

1. Select Published Services of your gateway group from the side navigation bar, then click the service you want to modify, for example, httpbin with version 1.0.0.
2. Under the published service, select Routes from the side navigation bar.
3. Select your target route, for example, get-ip.
4. In the Plugin field, click Enable Plugin.
5. Search for the Key Auth Plugin, then click Enable.
6. In the dialog box, do the following：

• Add the following configuration to the JSON Editor:

  {
  }

• Click Enable.

ADC

Coming soon.

Ingress Controller

Update your Kubernetes manifest file of the route as such:

httpbin-route.yaml

apiVersion: apisix.apache.org/v2
kind: ApisixRoute
metadata:
  name: httpbin
  # namespace: api7    # replace with your namespace
spec:
  http:
    - name: get-ip
      match:
        paths:
          - /ip
        methods:
          - GET
      backends:
        - serviceName: httpbin
          servicePort: 80
      plugins:
        - name: limit-req
          enable: true 
          config:
            time_window: 60
            count: 3
            key_type: var
            rejected_code: 429
            rejected_msg: Too many requests
            key: remote_addr
            policy: local
            allow_degradation: false
            show_limit_quota_header: true
        - name: key-auth
          enable: true 

Apply the configuration to your cluster:

kubectl apply -f httpbin-route.yaml

Validate

To validate, send five consecutive requests with Alice's key:

resp=$(seq 5 | xargs -I{} curl "http://127.0.0.1:9080/ip" -H 'apikey: alice-key' -o /dev/null -s -w "%{http_code}\n") && \
  count_200=$(echo "$resp" | grep "200" | wc -l) && \
  count_429=$(echo "$resp" | grep "429" | wc -l) && \
  echo "200": $count_200, "429": $count_429

You should see the following response, showing that out of the 5 requests, 3 requests were successful (status code 200) while the others were rejected (status code 429).

200:    3, 429:    2

Additional Resources

• Key Concepts
  • Services
  • Routes
  • Plugins
  • Consumers
• Plugin Hub
  • Limit Count
  • Limit Req