rate limit for rest api using spring

Onki :

I want to implement rate limiting functionality for rest API. After exploring through all articles, it looks like there is no rate limiting api directly provided by spring.

But there are 2 libraries which provides rate limiting functionality :

1) bucket4j-spring-boot-starter

2) weddini/spring-boot-throttling

Now I have a very silly question.How to verify whether these API belong to spring framework itself and meant to secure rest API on Spring MVC or these are 3rd party libraries developed using spring.

Our main target is to use spring framework and the functionality provided by it. And avoid 3rd party libraries.

I followed many questions on stackoverflow and googled other articles raised on this topic. Some of them mentions that "spring does not provide out of the box functionality on this". But I want to know what basic functionality spring provides on this. We are not looking for any out of the box solution, any basic solution will also work.

reference question : How to set rate limit for each user in Spring Boot?

jpganz18 :

Now I have a very silly question.How to verify whether these API belong to spring framework itself and meant to secure rest API on Spring MVC or these are 3rd party libraries developed using spring.

You can easily check on their dependencies...

<dependency>
    <groupId>com.giffing.bucket4j.spring.boot.starter</groupId>
    <artifactId>bucket4j-spring-boot-starter-context</artifactId>
    <version>0.1.15</version>
</dependency>

While all spring dependencies have this groupId

<groupId>org.springframework.boot</groupId>

You can even find the author here

https://github.com/MarcGiffing/bucket4j-spring-boot-starter

But I want to know what basic functionality spring provides on this.

That is a very broad topic but in simple terms:

• You can check who is requesting the endpoint by getting information for the token or any other authentication you are using.

• You can store that information in a database (in memory or not) and check it to verify the user still have more allowed requests

• You can deny a call relying on those parameters

All of them are supported by spring