limit-count
The limit-count
plugin uses a fixed window algorithm to limit the rate of requests by the number of requests within a given time interval. Requests exceeding the configured quota will be rejected.
Examples
The examples below demonstrate how you can configure limit-count
in different scenarios.
Apply Rate Limiting by Remote Address
The following example demonstrates the rate limiting of requests by a single variable, remote_addr
.
Create a route with limit-count
plugin that allows for a quota of 1 within a 30-second window per remote address:
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "limit-count-route",
"uri": "/get",
"plugins": {
"limit-count": {
"count": 1,
"time_window": 30,
"rejected_code": 429,
"key_type": "var",
"key": "remote_addr"
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"httpbin.org:80": 1
}
}
}'
Send a request to verify:
curl -i "http://127.0.0.1:9080/get"
You should see an HTTP/1.1 200 OK
response.
The request has consumed all the quota allowed for the time window. If you send the request again within the same 30-second time interval, you should receive an HTTP/1.1 429 Too Many Requests
response, indicating the request surpasses the quota threshold.
Apply Rate Limiting by Remote Address and Consumer Name
The following example demonstrates the rate limiting of requests by a combination of variables, remote_addr
and consumer_name
. It allows for a quota of 1 within a 30-second window per remote address and for each consumer.
Create two consumers, jane
and john
, and enable key authentication:
curl "http://127.0.0.1:9180/apisix/admin/consumers" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"username": "jane",
"plugins": {
"key-auth": {
"key": "jane-key"
}
}
}'
curl "http://127.0.0.1:9180/apisix/admin/consumers" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"username": "john",
"plugins": {
"key-auth": {
"key": "john-key"
}
}
}'
Create a route with key-auth
and limit-count
plugins:
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "limit-count-route",
"uri": "/get",
"plugins": {
"key-auth": {},
"limit-count": {
"count": 1,
"time_window": 30,
"rejected_code": 429,
"key_type": "var_combination",
"key": "$remote_addr $consumer_name"
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"httpbin.org:80": 1
}
}
}'
❶ key-auth
: enable key authentication on the route.
❷ key_type
: set to var_combination
to interpret the key
is as a combination of variables.
❸ key
: set to $remote_addr $consumer_name
to apply rate limiting quota by remote address and consumer.
Send a request as the consumer jane
:
curl -i "http://127.0.0.1:9080/get" -H 'apikey: jane-key'
You should see an HTTP/1.1 200 OK
response with the corresponding response body.
This request has consumed all the quota set for the time window. If you send the same request as the consumer jane
within the same 30-second time interval, you should receive an HTTP/1.1 429 Too Many Requests
response, indicating the request surpasses the quota threshold.
Send the same request as the consumer john
within the same 30-second time interval:
curl -i "http://127.0.0.1:9080/get" -H 'apikey: john-key'
You should see an HTTP/1.1 200 OK
response with the corresponding response body, indicating the request is not rate limited.
Send the same request as the consumer john
again within the same 30-second time interval, you should receive an HTTP/1.1 429 Too Many Requests
response.
This verifies the plugin rate limits by the combination of variables, remote_addr
and consumer_name
.
Share Quota Among Routes
The following example demonstrates the sharing of rate limiting quota Among multiple routes by configuring the group
of the limit-count
plugin.
Note that the configurations of the limit-count
plugin of the same group
should be identical. To avoid update anomalies and repetitive configurations, you can create a service with limit-count
plugin and upstream for routes to connect to.
Create a service:
curl "http://127.0.0.1:9180/apisix/admin/services" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "limit-count-service",
"plugins": {
"limit-count": {
"count": 1,
"time_window": 30,
"rejected_code": 429,
"group": "srv1"
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"httpbin.org:80": 1
}
}
}'
Create two routes and configure their service_id
to be 1
, so that they share the same configurations for the plugin and upstream:
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "limit-count-route-1",
"service_id": "limit-count-service",
"uri": "/get1",
"plugins": {
"proxy-rewrite": {
"uri": "/get"
}
}
}'
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "limit-count-route-2",
"service_id": "limit-count-service",
"uri": "/get2",
"plugins": {
"proxy-rewrite": {
"uri": "/get"
}
}
}'
The proxy-rewrite
plugin is used to rewrite the URI to /get
so that requests are forwarded to the correct endpoint.
Send a request to route /get1
:
curl -i "http://127.0.0.1:9080/get1"
You should see an HTTP/1.1 200 OK
response with the corresponding response body.
Send the same request to route /get2
within the same 30-second time interval:
curl -i "http://127.0.0.1:9080/get2"
You should receive an HTTP/1.1 429 Too Many Requests
response, which verifies the two routes share the same rate limiting quota.
Share Quota Among APISIX Nodes with a Redis Server
The following example demonstrates the rate limiting of requests across multiple APISIX nodes with a Redis server, such that different APISIX nodes share the same rate limiting quota.
On each APISIX instance, create a route with the following configurations. Adjust the address of the Admin API accordingly.
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "limit-count-route",
"uri": "/get",
"plugins": {
"limit-count": {
"count": 1,
"time_window": 30,
"rejected_code": 429,
"key": "remote_addr",
"policy": "redis",
"redis_host": "192.168.xxx.xxx",
"redis_port": 6379,
"redis_password": "p@ssw0rd",
"redis_database": 1
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"httpbin.org:80": 1
}
}
}'
❶ policy
: set to redis
to use a Redis instance for rate limiting.
❷ redis_host
: set to Redis instance IP address.
❸ redis_port
: set to Redis instance listening port.
❹ redis_password
: set to the password of the Redis instance, if any.
❺ redis_database
: set to the database number in the Redis instance.
Send a request to an APISIX instance:
curl -i "http://127.0.0.1:9080/get"
You should see an HTTP/1.1 200 OK
response with the corresponding response body.
Send the same request to a different APISIX instance within the same 30-second time interval, you should receive an HTTP/1.1 429 Too Many Requests
response, verifying routes configured in different APISIX nodes share the same quota.
Share Quota Among APISIX Nodes with a Redis Cluster
You can also use a Redis cluster to apply the same quota across multiple APISIX nodes, such that different APISIX nodes share the same rate limiting quota.
Ensure that your Redis instances are running in cluster mode. A minimum of two nodes are required for the limit-count
plugin configurations.
On each APISIX instance, create a route with the following configurations. Adjust the address of the Admin API accordingly.
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${ADMIN_API_KEY}" \
-d '{
"id": "limit-count-route",
"uri": "/get",
"plugins": {
"limit-count": {
"count": 1,
"time_window": 30,
"rejected_code": 429,
"key": "remote_addr",
"policy": "redis-cluster",
"redis_cluster_nodes": [
"192.168.xxx.xxx:6379",
"192.168.xxx.xxx:16379"
],
"redis_password": "p@ssw0rd",
"redis_cluster_name": "redis-cluster-1",
"redis_cluster_ssl": true
}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"httpbin.org:80": 1
}
}
}'
❶ policy
: set to redis-cluster
to use a Redis cluster for rate limiting.
❷ redis_cluster_nodes
: set to Redis node addresses in the Redis cluster.
❸ redis_password
: set to the password of the Redis cluster, if any.
❹ redis_cluster_name
: set to the Redis cluster name.
➎ redis_cluster_ssl
: enable SSL/TLS communication with Redis cluster.
Send a request to an APISIX instance:
curl -i "http://127.0.0.1:9080/get"
You should see an HTTP/1.1 200 OK
response with the corresponding response body.
Send the same request to a different APISIX instance within the same 30-second time interval, you should receive an HTTP/1.1 429 Too Many Requests
response, verifying routes configured in different APISIX nodes share the same quota.