Provide Quota Filter based on redis

[HappyTobi]

Hey there,

what do you think of a new quota filter (based on redis) where you can use a limit and different period "units" like: "second","minute","day","month","year","abs"

filters:
   - name: RequestQuotaFilter
      args:
         key-resolver: "principalNameKeyResolver"
         redis-quota-filter:
         limit: 10
        period: "DAY"

With a quota filter it would be easy to create one click urls, api-key urls or some other things.
Filter will give you the possibility to limited a quota with periods you really need.

Currently you can only limit a quote by using the rate limiter where you can't setup a fine-grained quota (because the filter is not for setting up a quota check 😀).

So if you like the idea, i would like to implement the new Filter that can handle specific quotas for routes / service.
To use it in a more generic way you can add your custom key-resolver (like the rate limiter).

What do you think?

If you like it, I can bring that feature / filter in.

Kind regards

[EstebanDugueperoux2]

Hello,

Is PR #1432 replaces PR #1433?
I'm interested by your work and more especially by a mean to define for a OAuth2 client_id differents rateLimit/Quota with different time periods.
For example, for a OAuth2 client_id a limit of 40 requests/minutes plus a limit of 10.000 requests/day and a limit of 50.000 requests/month.
Instead of having a second period specific rate limiter could we have a more generic one with a specified time period?
Because If I don't mistake, the only difference between Quota and Rate Limiting is the defined period of time. A short time for rate limiting and a long period for Quota.

And instead of using a java.util.concurrent.TimeUnit, could we use a java.time.Duration or a java.time.Period, both inheriting from java.time.temporal.TemporalAmount?

Best Regards.

[HappyTobi]

Hi @EstebanDugueperoux2

The PR #1433 replaces the Is PR #1432 .
There is more than just period also the logic is different.

For me both filters are complete different.

• The RateLimiter is more to secure your services behind the gateway that they will not going down if too much traffic comes in. (You can also allow some bursts)

• With the QuotaFilter you can limit a Service call with a Quota. The API Gateway will block all requests after the quota will be reached till a new period begin.
  With that filter you can limit a call to your service based on a e.g Authorization Header check to x per Day.

Kind Regards.

[EstebanDugueperoux2]

Hello HappyTobi,

Ok I understand with rateLimiting the period is small and is a sliding window while with quota the period can be high and with a fixed window.

When testing your PR, I get tokensRemaining becoming negative, is it expected?

Best Regards.

[HappyTobi]

Hi @EstebanDugueperoux2,

i changed that, think it's better to return 0 instead of -1.

Kind regards

[liemng]

Is there a reason why this was not merged? Seems like a very useful feature to have...