authgear / authgear/authgear-server
Add "rate" for GCRA related rate limit config
- Dominant language
- Go
- Stars
- 2k
- Forks
- 125
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 32
Description
Currently our rate limit use `period` and `burst` as the rate limit config. Assume the `rate = period / burst` in the GCRA algorithm
It would be more flexible in some cases, where users can specify a different value for rate and burst.
For example, if an API limits is 10 req / minute
```
period: 1m
burst: 10
```
It would actually allows 10+10 = 20 calls/min during burst, and keep 10 calls per minute afterwards
With a different value for `rate`, if the users want to have a strict limits of 10 req/min, but ok with limiting to 5 req/min after burst, they can config as follows:
```
period: 1m
rate: 5
burst: 5
```
Or even, if the users really know what they are doing, they can disable burst at all:
```
period: 1m
rate: 10
burst: 0
```
For both backward compatibility and keep it simple for most users, it is ideal to keep the current default as is, aka when `rate` is not specified, `rate=burst `
Contributor guide
Research direction
Start by locating the GCRA rate-limit configuration and implementation in the Go repository, then trace how period and burst are converted into the current rate. Define how an optional rate and burst: 0 behave while preserving the existing default, and add coverage for the documented 10-request-per-minute examples and backward compatibility.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100