Add a Per-Client Rate Limiter: Code Review Practice

Scrapers have been hammering /products and /search, and the database feels it at peak. This adds rate limiting middleware: each client gets 100 requests per minute, keyed on X-Forwarded-For since we sit behind the load balancer. It wraps the whole mux in main.go, and there are tests for the limit and the client key.

Ainternal/middleware/ratelimit.go1 of 3

Files Changed

internal/middleware/

cmd/api/

internal/middleware/ratelimit.go

Go · Click a line number to comment · Tap a line to comment

@@ -0,0 +1,63 @@

package middleware

import (

"net"

"net/http"

"strings"

"time"

)

// RateLimiter allows each client Limit requests per Window.

type RateLimiter struct {

Limit int

Window time.Duration

clients map[string]*window

}

type window struct {

start time.Time

count int

}

func NewRateLimiter(limit int, period time.Duration) *RateLimiter {

return &RateLimiter{

Limit: limit,

Window: period,

clients: make(map[string]*window),

}

// Middleware rejects requests from clients that are over their limit.

func (rl *RateLimiter) Middleware(next http.Handler) http.Handler {

return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

if !rl.allow(clientKey(r), time.Now()) {

http.Error(w, "rate limit exceeded", http.StatusInternalServerError)

return

}

next.ServeHTTP(w, r)

})

}

func (rl *RateLimiter) allow(key string, now time.Time) bool {

start := now.Truncate(rl.Window)

win, ok := rl.clients[key]

if !ok || !win.start.Equal(start) {

rl.clients[key] = &window{start: start, count: 1}

return true

}

if win.count >= rl.Limit {

return false

}

win.count++

return true

}

// clientKey identifies the caller, preferring the address the proxy saw.

func clientKey(r *http.Request) string {

if fwd := r.Header.Get("X-Forwarded-For"); fwd != "" {

return strings.TrimSpace(strings.Split(fwd, ",")[0])

}

host, _, _ := net.SplitHostPort(r.RemoteAddr)

return host

}

internal/middleware/ratelimit.go

cmd/api/main.go

internal/middleware/ratelimit_test.go