Investigate rate limiting strategies

[PatStLouis]

Rate Limiting Strategy - Quick Summary

Problem

No rate limiting currently implemented - vulnerable to abuse, DDoS, and resource exhaustion.

Options

Option	Best For	Pros	Cons
Redis-based	Multi-instance	Shared state, distributed	Requires Redis
In-memory	Single-instance	Fast, simple	Not shared
FastAPI-Limiter	Quick setup	Ready-made, easy	Less flexible
Nginx/Ingress	Infrastructure	First-line defense	Less granular

Recommended Approach

Phase 1: Redis-based distributed rate limiting using fastapi-limiter or custom middleware

• Token bucket algorithm
• Per-IP and per-API-key limits
• Endpoint-specific limits

Priority Limits

Endpoint	Limit	Window	Key
DID Resolution (GET)	100	1 min	IP
DID Creation (POST)	10	1 min	IP
DID Update (POST)	20	1 min	IP
Authenticated API	1000	1 min	API Key

Response Format

429 Too Many Requests:

{
  "error": "rate_limit_exceeded",
  "message": "Rate limit exceeded. Limit: 100 requests/minute",
  "retry_after": 60,
  "limit": 100,
  "remaining": 0
}