Best practice for rate limiting users of a REST API?

ruby-on-rails rest scaling capacity
frankodwyer picture frankodwyer · Mar 5, 2009 · Viewed 9.8k times · Source

I am putting together a REST API and as I'm unsure how it will scale or what the demand for it will be, I'd like to be able to rate limit uses of it as well as to be able to temporarily refuse requests when the box is over capacity or if there is some kind of slashdotted scenario.

I'd also like to be able to gracefully bring the service down temporarily (while giving clients results that indicate the main service is offline for a bit) when/if I need to scale the service by adding more capacity.

Are there any best practices for this kind of thing? Implementation is Rails with mysql.

Answer

temoto picture temoto · Mar 5, 2009

This is all done with outer webserver, which listens to the world (i recommend nginx or lighttpd).

Regarding rate limits, nginx is able to limit, i.e. 50 req/minute per each IP, all over get 503 page, which you can customize.

Regarding expected temporary down, in rails world this is done via special maintainance.html page. There is some kind of automation that creates or symlinks that file when rails app servers go down. I'd recommend relying not on file presence, but on actual availability of app server.

But really you are able to start/stop services without losing any connections at all. I.e. you can run separate instance of app server on different UNIX socket/IP port and have balancer (nginx/lighty/haproxy) use that new instance too. Then you shut down old instance and all clients are served with only new one. No connection lost. Of course this scenario is not always possible, depends on type of change you introduced in new version.

haproxy is a balancer-only solution. It can extremely efficiently balance requests to app servers in your farm.

For quite big service you end-up with something like:

  • api.domain resolving to round-robin N balancers
  • each balancer proxies requests to M webservers for static and P app servers for dynamic content. Oh well your REST API don't have static files, does it?

For quite small service (under 2K rps) all balancing is done inside one-two webservers.

Related questions

"render :nothing => true" returns empty plaintext file?

I'm on Rails 2.3.3, and I need to make a link that sends a post request. I have one that looks like this: = link_to('Resend Email', {:controller => 'account', :action => 'resend_confirm_email'}, {:method => :post} ) Which makes the …

Read More
Rails new vs create

Why is there a need to define a new method in RESTful controller, follow it up with a create method? Google search didn't provide me the answer I was looking for. I understand the difference, but need to know why …

Read More
Generate a controller with all the RESTful functions

I am trying to generate a controller with all the RESTful actions stubbed. I had read at Wikibooks - Ruby on Rails that all I needed to do was to call the generator with the controller name and I would …

Read More