Rolling window limits?

[eugenemiretsky]

Hi!
Does the library support rolling windows limits?
For example, if my limit is 60 per hour, there are 2 ways to go about it

1. If the user hits the limit, she has to wait for 1 hour before the limit resets. Making even one call during the one hour time period will extend the limit by another hour. For example: if I made 60 calls in 1 hour, and then make one call in 1:59, I will be rate limited, and will have to wait for until 2:59 for the limit it reset )
2. The limits get incremented as the time window slides, to always count only the events in the last hour. For example: if I made 60 calls in 1 hour (5 of which were in the first minute), and 1:01 I am allowed to make 5 more calls.

Based on reading the code, I think only 1 is supported, but just want to make sure

[mattklein123]

Windowed limits are not currently supported.

[andrascz]

Would you be interested in something like https://github.com/brandur/redis-cell?
This practically shifts the rate limit algorithm implementation from the service to Redis, but I think could be implemented with minimal effort.

[mattklein123]

@andrascz it might be interesting to support something like that, though I think to be useful we would need to support those commands with whatever sharding/cluster system is being used. A single redis host is not going to scale in most deployments.

[andrascz]

I am not 100% sure as I did not try it on cluster, but based on brandur/redis-cell#30, either it is already working or needs minimal tweaks.

[walbertus]

@mattklein123 If the redis-cell support sentinel and cluster setup, will envoyproxy/ratelimit use it? Or you are inclined toward internal code implementation?

[mattklein123]

@mattklein123 If the redis-cell support sentinel and cluster setup, will envoyproxy/ratelimit use it?

Can you describe more what you are proposing?

[walbertus]

There are two possible approaches to support rolling window limits:

1. Use redis-cell then create a new cache impl that uses redis-cell commands
2. Implement rolling window limit logic in new cache impl with basic Redis commands

The first approach would create a dependency on redis-cell module and shifting implementation to Redis.
This is a tradeoff between creating dependency vs maintaining implementation, which approach does the maintainer prefer?

[mattklein123]

In general I think (2) is better, but I have no objection to having an option that requires redis-cell as long as it is opt-in.

[exagil]

Has there been a decision on an algorithm for rolling window rate limiting yet?

[ysawa0]

I don't think there was a decision made to strictly use a certain algorithm. There was work being done in #243 and #193 to implement rolling window but it's gone stale unfortunately.