API Rate Limiting: zaschita ot zloupotrebleniy

Rate Limiting ogranichivaet kolichestvo zaprosov k API, zaschischaya ot peregruzki i zloupotrebleniy.

Algoritmy Rate Limiting

Fixed Window

Prostoy schyotchik za fiksirovannyy period. Problema: burst v granitse okna.

Sliding Window

Bolee plavnoe ogranichenie, slozhnee v realizatsii.

Token Bucket

Gibkiy algoritm: "tokeny" popolnyayutsya so vremenem, zaprosy ih potreblyayut.

Laravel Throttle

Vstroennaya zaschita:

// Route throttleRoute::middleware('throttle:60,1')->group(function () {    Route::get('/api/users', [UserController::class, 'index']);});

// Dinamicheskiy rate limitRateLimiter::for('api', function (Request $request) {    return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());});

Redis dlya Rate Limiting

Atomarnye operatsii Redis:

// Increment s TTLMULTIINCR user:123:requestsEXPIRE user:123:requests 60EXEC

HTTP Headers

Informirovanie klientov:

X-RateLimit-Limit: 60X-RateLimit-Remaining: 42X-RateLimit-Reset: 1640995200Retry-After: 30

Best Practices

• Raznye limity dlya raznyh endpoint
• Bolee strogie limity dlya autentifikatsii
• Graceful degradation
• Monitoring popytok obhoda