Rate limiter
Systems and methods of rate limiting are disclosed herein. In some example embodiments, a rate limiter service receives a request from an online application to access an online resource, and the rate limiter service transmits an indication of the request to a back end system, and an enforcement decision corresponding to the online resource is received from the back end system, with the enforcement decision comprising an instruction to either permit or deny access to the online resource, and the receiving of the enforcement decision from the back end system being performed asynchronously with the receiving of the request and the transmitting of the indication. In some example embodiments, the enforcement decision received from the back end system is stored, the stored enforcement decision is accessed in response to the receiving of the request, and the request is responded to using the accessed enforcement decision.
1. A system comprising:
at least one hardware processor; and
a non-transitory computer-readable medium storing executable instructions that, when executed, cause the at least one processor to perform operations comprising:
receiving, by a rate limiter service, a request from an online application to access an online resource;
transmitting, by the rate limiter service, an indication of the request to a back end system;
receiving, from the back end system, an enforcement decision corresponding to the online resource, the enforcement decision comprising an instruction to either permit or deny access to the online resource, the receiving of the enforcement decision from the back end system being performed asynchronously with the receiving of the request and the transmitting of the indication;
storing the enforcement decision received from the back end system;
accessing the stored enforcement decision in response to the receiving of the request; and
responding to the request using the accessed enforcement decision.
2. The system of claim 1 , wherein the operations further comprise:
determining, by the back end system, the enforcement decision based on a history of usage of the online resource and one or more rules, the determining of the enforcement decision being performed asynchronously with the transmitting of the indication of the request by the rate limiter service.
3. The system of claim 2 , wherein the operations further comprise:
transmitting, by the back end system, the enforcement decision to the rate limiter service asynchronously with the transmitting of the indication of the request by the rate limiter service,
wherein the storing the enforcement decision received from the back end system comprises storing, by the rate limiter service, the enforcement decision,
wherein the accessing the stored enforcement decision in response to the receiving of the request comprises accessing, by the rate limiter service, the stored enforcement decision in response to the receiving of the request, and
wherein the responding to the request using the accessed enforcement decision comprises transmitting the accessed enforcement decision to an enforcement module of the online application, the enforcement module being configured to implement the enforcement decision.
4. The system of claim 2 , wherein the operations further comprise:
transmitting, by the back end system, the enforcement decision to an enforcement module of the online application asynchronously with the transmitting of the indication of the request by the rate limiter service,
wherein the storing the enforcement decision received from the back end system comprises storing, by the enforcement module of the online application, the enforcement decision,
wherein the accessing the stored enforcement decision in response to the receiving of the request comprises accessing, by the enforcement module of the online application, the stored enforcement decision in response to the receiving of the request, and
wherein the responding to the request using the accessed enforcement decision comprises implementing, by the enforcement module of the online application, the enforcement decision.
5. The system of claim 2 , wherein the one or more rules comprises one or more of a maximum limit of requests that can be serviced within a predetermined period of time, a maximum limit of a type of request that can be serviced within a predetermined period of time, a maximum limit of requests or types of requests associated with a single Internet Protocol (IP) address that can be serviced within a predetermined period of time, and a maximum limit of requests or types of requests associated with a particular mobile device that can be serviced within a predetermined period of time.
6. The system of claim 1 , wherein the indication of the request indicates a type of the request.
7. The system of claim 1 , wherein the online application comprises a web application.
8. A computer-implemented method comprising:
receiving, by a rate limiter service, a request from an online application to access an online resource;
transmitting, by the rate limiter service, an indication of the request to a back end system;
receiving, from the back end system, an enforcement decision corresponding to the online resource, the enforcement decision comprising an instruction to either permit or deny access to the online resource, the receiving of the enforcement decision from the back end system being performed asynchronously with the receiving of the request and the transmitting of the indication;
storing the enforcement decision received from the back end system;
accessing the stored enforcement decision in response to the receiving of the request; and
responding to the request using the accessed enforcement decision.
9. The computer-implemented method of claim 8 , further comprising:
determining, by the back end system, the enforcement decision based on a history of usage of the online resource and one or more rules, the determining of the enforcement decision being performed asynchronously with the transmitting of the indication of the request by the rate limiter service.
10. The computer-implemented method of claim 9 , further comprising:
transmitting, by the back end system, the enforcement decision to the rate limiter service asynchronously with the transmitting of the indication of the request by the rate limiter service,
wherein the storing the enforcement decision received from the back end system comprises storing, by the rate limiter service, the enforcement decision,
wherein the accessing the stored enforcement decision in response to the receiving of the request comprises accessing, by the rate limiter service, the stored enforcement decision in response to the receiving of the request, and
wherein the responding to the request using the accessed enforcement decision comprises transmitting the accessed enforcement decision to an enforcement module of the online application, the enforcement module being configured to implement the enforcement decision.
11. The computer-implemented method of claim 9 , further comprising:
transmitting, by the back end system, the enforcement decision to an enforcement module of the online application asynchronously with the transmitting of the indication of the request by the rate limiter service,
wherein the storing the enforcement decision received from the back end system comprises storing, by the enforcement module of the online application, the enforcement decision,
wherein the accessing the stored enforcement decision in response to the receiving of the request comprises accessing, by the enforcement module of the online application, the stored enforcement decision in response to the receiving of the request, and
wherein the responding to the request using the accessed enforcement decision comprises implementing, by the enforcement module of the online application, the enforcement decision.
12. The computer-implemented method of claim 9 , wherein the one or more rules comprises one or more of a maximum limit of requests that can be serviced within a predetermined period of time, a maximum limit of a type of request that can be serviced within a predetermined period of time, a maximum limit of requests or types of requests associated with a single Internet Protocol (IP) address that can be serviced within a predetermined period of time, and a maximum limit of requests or types of requests associated with a particular mobile device that can be serviced within a predetermined period of time.
13. The computer-implemented method of claim 8 , wherein the indication of the request indicates a type of the request.
14. The computer-implemented method of claim 8 , wherein the online application comprises a web application.
15. A non-transitory machine-readable storage medium storing a set of instructions that, when executed by at least one processor, causes the at least one processor to perform operations comprising:
receiving, by a rate limiter service, a request from an online application to access an online resource;
transmitting, by the rate limiter service, an indication of the request to a back end system;
receiving, from the back end system, an enforcement decision corresponding to the online resource, the enforcement decision comprising an instruction to either permit or deny access to the online resource, the receiving of the enforcement decision from the back end system being performed asynchronously with the receiving of the request and the transmitting of the indication;
storing the enforcement decision received from the back end system;
accessing the stored enforcement decision in response to the receiving of the request; and
responding to the request using the accessed enforcement decision.
16. The non-transitory machine-readable storage medium of claim 15 , wherein the operations further comprise:
determining, by the back end system, the enforcement decision based on a history of usage of the online resource and one or more rules, the determining of the enforcement decision being performed asynchronously with the transmitting of the indication of the request by the rate limiter service.
17. The non-transitory machine-readable storage medium of claim 16 , wherein the operations further comprise:
transmitting, by the back end system, the enforcement decision to the rate limiter service asynchronously with the transmitting of the indication of the request by the rate limiter service,
wherein the storing the enforcement decision received from the back end system comprises storing, by the rate limiter service, the enforcement decision,
wherein the accessing the stored enforcement decision in response to the receiving of the request comprises accessing, by the rate limiter service, the stored enforcement decision in response to the receiving of the request, and
wherein the responding to the request using the accessed enforcement decision comprises transmitting the accessed enforcement decision to an enforcement module of the online application, the enforcement module being configured to implement the enforcement decision.
18. The non-transitory machine-readable storage medium of claim 16 , wherein the operations further comprise:
transmitting, by the back end system, the enforcement decision to an enforcement module of the online application asynchronously with the transmitting of the indication of the request by the rate limiter service,
wherein the storing the enforcement decision received from the back end system comprises storing, by the enforcement module of the online application, the enforcement decision,
wherein the accessing the stored enforcement decision in response to the receiving of the request comprises accessing, by the enforcement module of the online application, the stored enforcement decision in response to the receiving of the request, and
wherein the responding to the request using the accessed enforcement decision comprises implementing, by the enforcement module of the online application, the enforcement decision.
19. The non-transitory machine-readable storage medium of claim 16 , wherein the one or more rules comprises one or more of a maximum limit of requests that can be serviced within a predetermined period of time, a maximum limit of a type of request that can be serviced within a predetermined period of time, a maximum limit of requests or types of requests associated with a single Internet Protocol (IP) address that can be serviced within a predetermined period of time, and a maximum limit of requests or types of requests associated with a particular mobile device that can be serviced within a predetermined period of time.
20. The non-transitory machine-readable storage medium of claim 15 , wherein the indication of the request indicates a type of the request.