Implement Server Side Rate limiter

[coolwednesday]

Build server side rate limiting for HTTP as well as gRPC support.

[0xEbrahim]

I want to work on this but i don't fully understand what you mean... so can you help me?

[sammy200-ui]

@coolwednesday! I'd like to work on this feature. Here's my proposed approach:

Implement rate limiting middleware for both HTTP and gRPC servers using a token bucket algorithm via golang.org/x/time/rate (already available in go.mod).

Design

1. HTTP Rate Limiter Middleware

Location: pkg/gofr/http/middleware/rate_limiter.go

Features:

• Configurable requests per second (RPS) limit
• Configurable burst size
• Per-IP rate limiting (default) with option for global limiting
• Returns HTTP 429 (Too Many Requests) when limit exceeded
• Metrics tracking for rate-limited requests

Configuration:

RATE_LIMIT_ENABLED=true
RATE_LIMIT_REQUESTS_PER_SECOND=100
RATE_LIMIT_BURST=10
RATE_LIMIT_PER_IP=true


app := gofr.New()
// Rate limiter will be automatically applied based on config
// Or manually:
app.UseMiddleware(middleware.RateLimiter(100, 10, true)) // rps, burst, perIP

2. gRPC Rate Limiter Interceptor
   Location: pkg/gofr/grpc_rate_limiter.go (interceptor functions)

Features:

Unary interceptor for single RPCs
Stream interceptor for streaming RPCs
Returns codes.ResourceExhausted (gRPC status) when exceeded
Shares configuration with HTTP middleware
Works with existing observability interceptors

[coolwednesday]

@sammy200-ui , Since @0xEbrahim also want to contribute, maybe both of you can collaborate together and pick up one. One of you can pick up HTTP and other can pick up gRPC.

[coolwednesday]

@0xEbrahim, @sammy200-ui , Please decide who is interested in implementing what ....and discuss the approach accordingly. @sammy200-ui , please do help @0xEbrahim with the details if required. If still any blockers, feel free to tag any of the maintainers.

[sammy200-ui]

That sounds good @coolwednesday, Happy to collaborate with you @0xEbrahim

@0xEbrahim - How about i work on HTTP rate limiter and you can do the gRPC rate limiter?

please let me know what you think

To avoid conflicts, we can Share the core rate limiter logic (common rate.Limiter wrapper) and also Work on separate branches

[0xEbrahim]

@sammy200-ui
I don't have any problems with your recommendation.
I will start tonight or tomorrow
Happ to collaborate with you @sammy200-ui

[sammy200-ui]

@0xEbrahim perfect!! , i will start with the building right now , just to clarify both implementations will use golang.org/x/time/rate directly from the standard library, so you can start on gRPC independently without waiting for me. The HTTP and gRPC implementations will be separate since they use different APIs.

I'll update you once I create a PR for the HTTP part!