Live data from Hacker News

How to Design a Scalable Rate Limiting Algorithm

konghq.com

21–30 of 36 posts

Re: How to Design a Scalable Rate Limiting Algorithm

#21

Earlier quoted context omitted.

Have you found any viable alternatives to Kong?

Not OP, but we are using Tyk (tyk.io) at my workplace. It's definitely more user friendly than Kong, but we've had other issues with it. Having not used Kong extensively but knowing what it is, I'll go out on a limb and say Kong is likely more performant.

Actually it should be the opposite. Definitely do your own benchmark, but take a look at the latest numbers from Tyk and compare it with the latest numbers from Kong to get a general idea.

Re: How to Design a Scalable Rate Limiting Algorithm

#22
post #14

Earlier quoted context omitted.

The problem here is, it depends on WHY you are rate limiting. If it's just to balance so you don't overload your backends, then absolutely this is a great way to do it. If however you are trying to limit client(s) because the service is an authentication gateway for instance, then you want to limit user/pass requests to X number then concurrency limiting isn't a good way to do that. So you may need both , depending o…

What is the use case for your second example? I am not following. Wouldn't that just be rate limiting by client IP though?

I heard about a case where someone built a phone app backend without rate limiting. Someone found this hole and successfully attacked 70,000 accounts by running password dictionary cracks against the authentication API.

Modern distributed systems are simply too fast and users are too dumb with picking passwords to allow unlimited password attempts.

Re: How to Design a Scalable Rate Limiting Algorithm

#23
post #14

Earlier quoted context omitted.

The problem here is, it depends on WHY you are rate limiting. If it's just to balance so you don't overload your backends, then absolutely this is a great way to do it. If however you are trying to limit client(s) because the service is an authentication gateway for instance, then you want to limit user/pass requests to X number then concurrency limiting isn't a good way to do that. So you may need both , depending o…

What is the use case for your second example? I am not following. Wouldn't that just be rate limiting by client IP though?

Well you can rate limit via a lot of things, definitely by IP is a good idea, but for ipv6, you typically want to limit by blocks(since every ipv6 user currently usually gets a full block of IP's), but you also probably want to also limit by username, i.e. if you keep trying to login as user 'root', you only get 3 attempts/minute or something.

After X attempts via the same IP, you can block/ban that IP via a FW rule/etc for say 5 mins. or 30m, or whatever.

It all depends on your security posture, you could go crazy and actually lock the account after 3 failures, but then you hand bad people a free DDOS... so you have to be careful about doing that.. But you could soft-lock and require a correct password and an email address verification after X failed attempts(i.e. correct login, plus they have to click a link in an email).

Anyways, see what I'm saying here? Authentication access is something you really want to get right, and it's a complicated topic.

Re: How to Design a Scalable Rate Limiting Algorithm

#24

For a different view on the topic watch "Stop Rate Limiting! Capacity Management Done Right" https://www.youtube.com/watch?v=m64SWl9bfvk The basic premise is not do do req/s limiting but rather concurrency limiting which results in req/s limiting by itself. Concurrency limiting is rather simple and doesn't require a lot of code complexity.

On the origin is he only measuring connections?

HTTP/1.1 says a single connection can contain more than one request. The client I use has this feature. "Modern" browsers do not.

Whether proxies pipeline requests to origin servers (irrespective of the client features) I do not know. But it seems like they could preserve some origin capacity that way. Perhaps they adhere to one request per connection.

Ideally, as a user, I think it would be useful to get more diagnostics in response headers on the health of the proxies and origins. Something more informative than HTTP status codes.

That way we can build "intelligent clients" that self-adjust to current conditions in response to diagnostics they get in the responses. (The presenter references the adaptive approach of the TCP congestion algorithm.)

Some websites return diagnostics in webpage content. But of course one only gets them after a successful (cf. failed) transaction. For example, I believe wikipedia.org or archive.vector.co.uk return some diagnostics on some aspect of their setup (probably not intended to be utilised by clients).

Re: How to Design a Scalable Rate Limiting Algorithm

#25
> A better approach is to use a “set-then-get” mindset, relying on atomic operators that implement locks in a very performant fashion, allowing you to quickly increment and check counter values without letting the atomic operations get in the way.

In a highly distributed system you’d probably want to avoid a centralised data store altogether for fast moving data like rate limits. CRDTs and bucket weighting might be a more effective strategy.

The article states that tracking per-node could cause a problem with race conditions but that assumes it’s the counter that’s the problem. If the node cluster is aware of the other nodes and the relative load of the cluster, you can use this value to weight the isolated rate limiter and the only data that needs to be shared can be broadcast between the nodes using a pub/sub mechanism.

If some variance is permitted (+/- a margin either side of the limit) then having the nodes synchronise their “token weight” based on the size of the cluster means that the nodes can then manage the rate limit in-memory without ever needing to track in a data store.

It does trade-off accuracy, but for accuracy you can then revert to the set-then-get centralised counter, the trade-off being performance because of increased round trip time to the day store.

In most rate limit scenarios, at least from what we’ve seen, extreme accuracy isn’t usually that important vs. being able to scale amd rate limit without having to also scale a data layer to handle the counters.

Re: How to Design a Scalable Rate Limiting Algorithm

#26

Earlier quoted context omitted.

Not OP, but we are using Tyk (tyk.io) at my workplace. It's definitely more user friendly than Kong, but we've had other issues with it. Having not used Kong extensively but knowing what it is, I'll go out on a limb and say Kong is likely more performant.

Actually it should be the opposite. Definitely do your own benchmark, but take a look at the latest numbers from Tyk and compare it with the latest numbers from Kong to get a general idea.

This analysis was done by BBVA comparing Tyk and Kong performance https://www.bbva.com/en/api-gateways-kong-vs-tyk/ - disclosure: I work for Kong, but Kong (the company) had no involvement with the benchmarking in that article.

Re: How to Design a Scalable Rate Limiting Algorithm

#27
post #26

Earlier quoted context omitted.

Actually it should be the opposite. Definitely do your own benchmark, but take a look at the latest numbers from Tyk and compare it with the latest numbers from Kong to get a general idea.

This analysis was done by BBVA comparing Tyk and Kong performance https://www.bbva.com/en/api-gateways-kong-vs-tyk/ - disclosure: I work for Kong, but Kong (the company) had no involvement with the benchmarking in that article.

The benchmarks for Tyk here seem somewhat off - it doesn’t look like it was set up correctly for production use.

Re: How to Design a Scalable Rate Limiting Algorithm

#28

Disregarding the article completely, I'll share my opinion on Kong because we use quite a bit at my workplace. We use an old version (0.9.x as of right now). The things I shared below might not be true anymore in new versions but I can't tell and are regarding the plugin system. IMO, the idea of taking things like authentication, rate limiting, etc in a proxy is a wonderful idea ( https://2tjosk2rxzc21medji3nfn1g-wpe…

Have you found any viable alternatives to Kong?

The "service mesh" space is starting to take off now with the rise of Kubernetes and containers.

Bouyant made LinkerD and now Conduit: https://buoyant.io/

Lyft created Envoy: https://www.envoyproxy.io

Istio uses Envoy for more functionality in K8S: https://istio.io

Re: How to Design a Scalable Rate Limiting Algorithm

#29
post #14

Earlier quoted context omitted.

The problem here is, it depends on WHY you are rate limiting. If it's just to balance so you don't overload your backends, then absolutely this is a great way to do it. If however you are trying to limit client(s) because the service is an authentication gateway for instance, then you want to limit user/pass requests to X number then concurrency limiting isn't a good way to do that. So you may need both , depending o…

What is the use case for your second example? I am not following. Wouldn't that just be rate limiting by client IP though?

>Wouldn't that just be rate limiting by client IP though?

This won't defeat an adversary with a botnet.

Re: How to Design a Scalable Rate Limiting Algorithm

#30

Earlier quoted context omitted.

Have you found any viable alternatives to Kong?

Not OP, but we are using Tyk (tyk.io) at my workplace. It's definitely more user friendly than Kong, but we've had other issues with it. Having not used Kong extensively but knowing what it is, I'll go out on a limb and say Kong is likely more performant.

Used Tyk with a similar experience. Generally very happy with it but the documentation was, at the time, a bit challenging.
Post reply on HN