Rate limiting

Feather offers two ways to rate limit. The decorator is convenient and keeps its counters in the process. Flask-Limiter with Redis shares counters between workers, which is what a limit needs in order to hold under more than one process.

The decorator

from feather.auth import rate_limit

# 5 login attempts per minute per IP
@api.post('/login')
@rate_limit(5, 60)
def login():
    pass

# 100 API calls per minute per authenticated user
@api.get('/search')
@rate_limit(100, 60, key='user')
def search():
    pass

# limit by both IP and user
@api.post('/expensive')
@rate_limit(10, 3600, key='ip+user')
def expensive_operation():
    pass

@api.post('/comments')
@rate_limit(10, 3600, message='You can only post 10 comments per hour')
def create_comment():
    pass

Parameter	Description	Default
`limit`	Max requests in the period	required
`period`	Time window in seconds	60
`key`	Limit by `'ip'`, `'user'` or `'ip+user'`	`'ip'`
`message`	Custom error message	”Rate limit exceeded”

@rate_limit keeps counters in the process. Under gunicorn --workers 4 a limit of ten per minute is really forty. Treat it as a development guard and a convenience for single-process deployments, not as protection.

In production: Flask-Limiter

Scaffolded apps with authentication ship a rate_limits.py that handles this properly. It limits the Google OAuth login and callback and every admin POST route through Flask-Limiter, sharing counters across workers via Redis.

pip install "feather-framework[ratelimit]"

.env

RATELIMIT_STORAGE_URI=redis://localhost:6379/1

Without it the limiter falls back to memory and logs a warning. The limits live in config.py as RATELIMIT_DEFAULT, RATELIMIT_LOGIN and RATELIMIT_ADMIN, each overridable by environment variable. Run flask limiter limits to see which routes are actually limited.

Two things that fail silently

Both cost real debugging time if you wire this up by hand.

Assign the wrapper back

Flask-Limiter enforces a limit only through the function it returns. Calling limiter.limit(rule)(app.view_functions[ep]) and discarding the result does nothing, and drops that endpoint out of the default limit as well.

app.view_functions[ep] = limiter.limit(rule)(view)

Exempt static endpoints

A single page load fetches ten or more scripts and fonts from Flask. Without a limiter.request_filter exempting static and feather_static, a busy user gets a 429 on the app’s own JavaScript while the page is still loading.

Exempt health checks

A platform probes /health/ready from one address every few seconds. At every 5 seconds that is 720 requests an hour, over the default 600, so about an hour after each deploy the app answers its own readiness check with 429 and is taken out of rotation. The scaffold exempts health.health_check, health.liveness_check and health.readiness_check in EXEMPT_ENDPOINTS in rate_limits.py.

Get started

Tutorial: build a Kanban app

Building the UI

Backend

Features

Tooling

Testing

Deployment

The decorator

In production: Flask-Limiter

Two things that fail silently

​The decorator

​In production: Flask-Limiter

​Two things that fail silently

The decorator

In production: Flask-Limiter

Two things that fail silently