authgear / authgear/authgear-server

Add "rate" for GCRA related rate limit config

Open
#3,125 0 comments 0 reactions 0 assignees View on GitHub
cooldown/minor-feature
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

Currently our rate limit use `period` and `burst` as the rate limit config. Assume the `rate = period / burst` in the GCRA algorithm

It would be more flexible in some cases, where users can specify a different value for rate and burst.

For example, if an API limits is 10 req / minute

```
period: 1m
burst: 10
```

It would actually allows 10+10 = 20 calls/min during burst, and keep 10 calls per minute afterwards

With a different value for `rate`, if the users want to have a strict limits of 10 req/min, but ok with limiting to 5 req/min after burst, they can config as follows:

```
period: 1m
rate: 5
burst: 5
```

Or even, if the users really know what they are doing, they can disable burst at all:

```
period: 1m
rate: 10
burst: 0
```

For both backward compatibility and keep it simple for most users, it is ideal to keep the current default as is, aka when `rate` is not specified, `rate=burst `

Contributor guide

Open the contributing guide

Research direction

Start by locating the GCRA rate-limit configuration and implementation in the Go repository, then trace how period and burst are converted into the current rate. Define how an optional rate and burst: 0 behave while preserving the existing default, and add coverage for the documented 10-request-per-minute examples and backward compatibility.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.