throttle per url in node.js restify

Question

The documentation states:

Note that you can always place this on per-URL routes to enable different request rates to different resources (if for example, one route, like /my/slow/database is much easier to overwhlem than /my/fast/memcache).

I am having trouble finding out how to implement this exactly.

Basically, I want to serve static files at a different throttle rate than my API.

Narcoanalysis

try this out restify-throttle @ GitHub – Gobert

Answer 1

Setup throttling (rate limiter) with restify for some endpoints like this.

    var rateLimit = restify.throttle({burst:100,rate:50,ip:true});
    server.get('/my/endpoint',
        rateLimit,
        function(req, res, next) {
            // Do something here
            return next();
        }
    );
    server.post('/another/endpoint',
        rateLimit,
        function(req, res, next) {
            // Do something here
            return next();
        }
    );

Or like this.

    server.post('/my/endpoint',
        restify.throttle({burst:100,rate:50,ip:true}),
        function(req, res, next) {
            // Do something here
            return next();
        }
    );

Even when throttling per endpoint a global throttle may still be desired, so that can be done like this.

    server.use(restify.throttle({burst:100,rate:50,ip:true});

(reference) Throttle is one of restify's plugins.

Budworth

What's the difference between rate and burst? – Virelay

Restify uses the token bucket algorithm to throttle traffic. With this, the burst value is the maximum possible number of requests per second, and the rate value is the average rate of requests per second. Even if requests are steady from a caller's perspective, the Restify server may not receive those requests at a steady pace (due to transmission congestion or other reasons), so the burst value provides some tolerance level beyond the average rate value. – Budworth

How do you know that the rate limit is met? Is there an error raised here? – Burma

@Aamir, on the server-side, a TooManyRequestsError is thrown. From the client-side, the caller should receive an HTTP 429 status, Too Many Requests. – Budworth

@MarkMaruska So, burst is the max value for the overall number of requests that the server would accept per second. And the rate is the max requests that a per IP can request? – Cystine

@VppMan The burst size and average rate (requests/second) translate to the Token bucket algorithm, with the ability to throttle on IP (or x-forwarded-for) and username (from req.username). – Budworth