Implement Rate Limiting for Anonymous Users

[brylie]

Objective

Implement a rate limiting mechanism to restrict the number of requests per user within a specified time period, ensuring fair usage and service stability for anonymous users.

Why

• Promote cost sustainability
• Ensure service stability
• Reduce resource usage
• Allow many people to enjoy the service equally

Description

We need to implement a rate limiting system that restricts the number of requests an anonymous user can make within a given time frame. This will help prevent abuse, ensure fair usage, and maintain the stability and performance of our service.

Tasks

1. Research and choose an appropriate rate limiting library (e.g., slowapi for FastAPI).
2. Implement rate limiting middleware:
   • Define rate limit (e.g., 10 requests per minute per IP address)
   • Set up error responses for when the rate limit is exceeded
3. Integrate the rate limiting middleware with our FastAPI application.
4. Implement user-friendly error messages when rate limit is reached.
5. Add configurable settings for rate limits (requests per minute, time window).
6. Implement logging for rate limit events.
7. Create a simple dashboard or endpoint for monitoring rate limit statistics.

Technical Considerations

• Use IP addresses to identify anonymous users (consider privacy implications).
• Ensure the rate limiting solution is compatible with async operations.
• Consider using Redis or a similar in-memory store for distributed rate limiting if needed.

Acceptance Criteria

• Rate limiting is correctly applied to all relevant endpoints.
• Users receive clear error messages when they exceed the rate limit.
• The system correctly tracks and resets rate limits based on the defined time window.
• Rate limit settings are configurable without code changes.
• Logging provides clear information about rate limit events.

Additional Notes

• Consider future scalability when choosing and implementing the rate limiting solution.
• Ensure the solution doesn't significantly impact response times for normal usage.
• Document the rate limiting behavior clearly for users.