java-rate-limit

Java library to embed rate limit control functionality inside applications.

Usage

import org.sputnik.ratelimit.domain.CanDoResponse;
import org.sputnik.ratelimit.service.JedisConfiguration;
import org.sputnik.ratelimit.service.RateLimiter;

class LoginManager {

  // Configure rate limiter to allow maximum 3 attempts every hour.
  RateLimiter vc = new RateLimiter(JedisConfiguration.builder().setHost("localhost").build(),
    new EventConfig("testLogin", 3, Duration.ofSeconds(3600)));

  private boolean doLogin(String username, String password) {
    boolean isValid = false;
    CanDoResponse response = vc.canDoEvent("testLogin", username);
    if (response.canDo()) {
      vc.doEvent("testLogin", username);
      // TODO: check credentials and set isValid value
    } else {
      log.warn(
        "User " + username + " blocked due to exceeding number of login attempt, for " + (response.waitMillis() / 1000) + " seconds");
      isValid = false;
    }

    if (isValid) {
      vc.reset("testLogin", username);
    }

    return isValid;
  }
} 

Maven & Gradle

For maven integration simply add this dependency to your pom.xml:

<dependency>
    <groupId>net.saltando</groupId>
    <artifactId>java-rate-limit</artifactId>
    <version>x.y.z</version>
</dependency>

For gradle integration simply add this dependency:

compile 'net.saltando:java-rate-limit:x.y.z'

Where x.y.x is the desired version, always lastest versions is recommended, you can find it at Releases tab.

Javadoc

Javadoc is available at https://javadoc.jitpack.io/com/github/jfisbein/java-rate-limit/latest/javadoc/index.html

Limitations

Event attempts are stored in Redis sorted sets (score = epoch millis) and pruned by time window. As no synchronization method is implemented around the full canDoEvent + doEvent workflow, some edge race conditions could still lead to false positive or negative responses under heavy concurrency.