Multi-tagged multi-tenant rate limiting

1. A method comprising:

receiving, by a processing device executing a reverse proxy, a first request at a first time, wherein the first request comprises a first tag associated with a first attribute and a second tag associated with a second attribute;

responsive to receiving the first request, determining whether timers have been started for the first tag and the second tag;

responsive to determining that timers have not been started for the first tag and the second tag, starting a first timer for the first tag of the first request based on a first rate limit associated with the first attribute, and a second timer for the second tag of the first request based on a second rate limit associated with the second attribute, wherein the first timer is different from the second timer, and wherein the second rate limit is higher than the first rate limit;

receiving a second request at a second time that occurs after the first time, wherein the second request comprises the first tag and the second tag;

responsive to determining that the second request violates the first rate limit for the first attribute, rejecting the second request;

receiving a third request at a third time that occurs after the second time, wherein the third request comprises the first tag and the second tag;

determining that the third request violates a second rate limit for the second attribute;

determining that the second rate limit is to be bypassed for the third request; and

forwarding the third request.

2. The method of claim 1 , wherein the first timer and the second timer are started at a same start time.

3. The method of claim 1 , wherein determining that the second request violates the first rate limit for the first attribute comprises:

determining that at the second time the second timer has expired and the first timer has not expired.

4. The method of claim 3 , wherein determining that the second request violates the first rate limit for the first attribute further comprising:

determining that a total number of requests that have been received between the first time and the second time meets a threshold value, wherein each of the requests comprises the first tag and the second tag, and wherein the threshold value is associated with the first attribute.

5. The method of claim 3 , wherein starting the first timer comprises:

creating a first entry in a hash table for the first tag;

creating a first object in a memory space, the first object comprising a first expiration time based on the first rate limit; and

associating the first entry with the first object.

6. The method of claim 5 , wherein determining that the first timer has not expired comprises:

accessing the first entry in the hash table for the first tag;

determining the first expiration time of the first object; and

comparing the second time to the first expiration time.

7. The method of claim 1 , wherein rejecting the second request comprises:

starting a third timer for the second tag based on the second rate limit, and

starting a bypass timer associated with the third timer, the bypass timer to expire at a same time as the third timer.

8. The method of claim 7 , wherein determining that the third request violates the second rate limit comprises:

determining that at the third time the first timer has expired and the third timer has not expired.

9. The method of claim 8 , wherein determining that the second rate limit is to be bypassed comprises:

determining that the bypass timer has not expired; and

starting a fourth timer for the first tag based on the first rate limit.

10. The method of claim 1 , wherein the third request is forwarded to a multi-tenant application, and wherein forwarding the third request to the multi-tenant application comprises:

determining a routing rule associated with the third request, wherein the routing rule is based on information contained in the third request; and

identifying the multi-tenant application using the routing rule.

11. The method of claim 9 , further comprising:

receiving a fourth request at a fourth time that occurs after the third time, wherein the fourth request comprises the second tag but not the first tag;

determining that at the fourth time the third timer has expired and the fourth timer has not expired;

starting a fifth timer for the second tag based on the second rate limit, and

forwarding the fourth request.

12. The method of claim 1 , further comprising:

wherein the first request is received from a first embedded system,

wherein the second request is received from at least one of the first embedded system or a second embedded system, and

wherein the third request is received from at least one of the first embedded system, the second embedded system or a third embedded system.

13. A method comprising:

receiving, by a processing device, a first request comprising a first tag associated with a first attribute and a second tag associated with a second attribute;

determining that a first rate limiter object is associated with the first tag, the first rate limiter object comprising a first expiration time and having been generated responsive to a previously received request and based on a first rate limit rule associated with the first tag;

rejecting the first request based on the first rate limiter object;

determining a second rate limit rule associated with the second tag of the first request, wherein the first rate limit rule is more restrictive than the second rate limit rule;

generating a second rate limiter object associated with the second tag, the second rate limiter object comprising a second expiration time, and wherein the second rate limiter object is different from the first rate limiter object; and

generating a rate limiter bypass object that references the first rate limiter object and the second rate limiter object, the rate limiter bypass object comprising the second expiration time, wherein the rate limiter bypass object is to prevent, responsive to satisfaction of one or more criteria, the second rate limiter object from causing a future request to be rejected.

14. The method of claim 13 , wherein the one or more criteria comprises:

a first criterion that the future request comprises the first tag and the second tag;

a second criterion that the first rate limiter object has expired at a time that the future request is received; and

a third criterion that the second rate limiter object has not expired at the time that the future request is received.

15. The method of claim 14 , further comprising:

receiving a second request comprising the first tag and the second tag;

determining that the first rate limiter object has expired;

determining that the second rate limiter object has not expired;

determining that the rate limiter bypass object that references the second rate limiter object is existent; and

forwarding the second request to a multi-tenant application.

16. The method of claim 14 , further comprising:

receiving a second request comprising the second tag but not the first tag;

determining that the first rate limiter object has expired;

determining that the second rate limiter object has not expired; and

rejecting the second request.

17. The method of claim 13 , wherein the first tag comprises a first one of an internet protocol (IP) address, an original equipment manufacturer (OEM) identifier, a token, or a user identifier and the second tag comprises a second one of the IP address, the OEM identifier, the token, or the user identifier.

18. The method of claim 13 , further comprising:

determining a number of requests from a device that have been rejected in a time period based on at least one of the first rate limit rule or the second rate limit rule;

determining that the number of requests exceeds a threshold; and

automatically adjusting at least one of the first rate limit rule or the second rate limit rule.

19. A non-transitory computer readable storage medium having instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

receiving, by a processing device executing a reverse proxy, a first request from an embedded system at a first time, the first request to be forwarded to a multi-tenant application, wherein the first request comprises a first tag associated with a first attribute of an embedded system and a second tag associated with a second attribute of the embedded system;

responsive to receiving the first request, determining whether timers have been started for the first tag and the second tag;

responsive to determining that timers have not been started for the first tag and the second tag, starting a first timer for the first tag of the first request based on a first rate limit associated with the first attribute, and a second timer for the second tag of the first request based on a second rate limit associated with the second attribute, wherein the first timer is different from the second timer, and wherein the second rate limit is higher than the first rate limit;

receiving a second request from the embedded system at a second time that occurs after the first time, the second request to be forwarded to the multi-tenant application, wherein the second request comprises the first tag and the second tag;

responsive to determining that at the second time the second timer has expired and the first timer has not expired,

rejecting the second request;

starting a third timer for the second tag of the second request based on the second rate limit, and

starting a bypass timer associated with the third timer, the bypass timer to expire at a same time as the third timer, wherein the bypass timer is to prevent responsive to satisfaction of one or more criteria, the third timer from causing a future request to be rejected.

20. The non-transitory computer readable storage medium of claim 19 , the operations further comprising:

receiving a third request from the embedded system at a third time that occurs after the second time, the third request to be forwarded to the multi-tenant application, wherein the third request comprises the first tag and the second tag; and

responsive to determining that at the third time the first timer has expired and the third timer has not expired,

determining that the bypass timer has not expired,

starting a fourth timer for the first tag of the third request based on the first rate limit, and

forwarding the third request to the multi-tenant application.