Rate Limiting in Django with Django-Ratelimit

Rate limiting is a crucial aspect of web application development, especially when you want to control the number of requests a user can make within a given time frame.

This is important for various reasons, such as preventing abuse, managing resources, and ensuring fair usage.

While Django, a high-level Python web framework, doesn't provide built-in rate limiting, there are several third-party packages that fill this gap.

One of the most popular among them is django-ratelimit.

GitHub of the project at:

What is Django-Ratelimit?

django-ratelimit is a Django middleware and decorator library that provides a simple and efficient way to limit the rate at which client requests can be made to your Django application.

It allows you to specify how many requests an IP address can make within a given time period.

The library is highly customizable, allowing you to set different rate limits for different views or even different methods within a single view.

Installation

Installing django-ratelimit is straightforward.

You can install it using pip:

pip install django-ratelimit

Basic Usage

The most common way to use django-ratelimit is by using its decorators.

Here's a simple example:

from django.http import HttpResponse
from django_ratelimit.decorators import ratelimit

@ratelimit(key='ip', rate='5/m', block=True)
def my_view(request):
    return HttpResponse('This is my view.')

In this example, the key parameter specifies that the rate limiting should be based on the client's IP address.

The rate parameter sets the limit to 5 requests per minute.

If the block parameter is set to True, any client that exceeds this rate will receive a 429 'Too Many Requests' response.

Advanced Usage

Other Keys

You can specify other keys for rate limiting.

For example, if you want to rate limit based on a user's ID, you can do so as follows:

@ratelimit(key='user', rate='5/m', block=True, method='ALL')
def my_view(request):
    return HttpResponse('This is my view.')

Multiple Rate Limits

You can also set multiple rate limits for a single view:

@ratelimit(key='ip', rate='5/m', block=True, method='GET')
@ratelimit(key='ip', rate='10/m', block=True, method='POST')
def my_view(request):
    return HttpResponse('This is my view.')

Using Middleware

If you want to apply rate limiting globally, you can use RatelimitMiddleware. Add it to your MIDDLEWARE setting in settings.py:

MIDDLEWARE = [
    # ...
    'django_ratelimit.middleware.RatelimitMiddleware',
    # ...
]

Configuration Options

django-ratelimit provides various configuration options that allow you to fine-tune how rate limiting works in your application.

Below are some examples that showcase these options.

Identifying Clients with key

• By IP Address: Use key='ip' to rate limit based on the client's IP address.
• By User ID: Use key='user' to rate limit based on the authenticated user's ID.
• Custom Function: Use key=custom_key_func, where custom_key_func is a function you define to generate a unique key based on the request.

Setting Rate Limits with rate

• 5 Requests Per Minute: Use rate='5/m' to allow 5 requests per minute.
• 10 Requests Per Hour: Use rate='10/h' to allow 10 requests per hour.
• 100 Requests Per Day: Use rate='100/d' to allow 100 requests per day.

Limiting Specific HTTP Methods with method

• GET Requests Only: Use method='GET' to rate limit only GET requests.
• GET and POST Requests: Use method=['GET', 'POST'] to rate limit both GET and POST requests.
• All HTTP Methods: Use method='ALL' to rate limit all types of HTTP methods.

Blocking Excessive Requests with block

• Block Excessive Requests: Use block=True to block requests that exceed the rate limit.
• Flag But Don't Block: Use block=False to allow the request but flag it as exceeding the rate limit.

Handling Exceeded Limits

When a client exceeds the rate limit, django-ratelimit will by default return a 429 'Too Many Requests' response.

You can customize this behavior by checking the request.limited attribute in your view:

@ratelimit(key='ip', rate='5/m', block=False)
def my_view(request):
    if getattr(request, 'limited', False):
        return HttpResponse('Too many requests', status=429)
    return HttpResponse('This is my view.')

Conclusion

django-ratelimit offers a flexible and easy-to-use way to implement rate limiting in your Django applications.

With its simple decorator syntax and middleware support, you can quickly add rate limiting to specific views or your entire application.

This helps you protect your resources and provide a fair service to all users.

Thank you for reading and I will see you on the Internet.

Follow me on Twitter: https://twitter.com/DevAsService

Check out my website at: https://developer-service.io/

Check out other articles that might interest you:

If you want to stay updated when I post a new article, you can signup for my free newsletter!