How do you implement rate limiting in a Go API — per user, per IP, and globally?

Question

Accepted Answer

import "golang.org/x/time/rate"

// Per-IP rate limiter store
type IPRateLimiter struct {
    limiters sync.Map
    rate     rate.Limit
    burst    int
}

func (l *IPRateLimiter) getLimiter(ip string) *rate.Limiter {
    val, _ := l.limiters.LoadOrStore(ip, rate.NewLimiter(l.rate, l.burst))
    return val.(*rate.Limiter)
}

func RateLimitMiddleware(limiter *IPRateLimiter) Middleware {
    return func(next http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            ip := r.RemoteAddr
            if !limiter.getLimiter(ip).Allow() {
                http.Error(w, "rate limit exceeded", http.StatusTooManyRequests)
                return
            }
            next.ServeHTTP(w, r)
        })
    }
}

// Distributed rate limiting with Redis
var rateLimitScript = redis.NewScript(`
    local key = KEYS[1]
    local limit = tonumber(ARGV[1])
    local window = tonumber(ARGV[2])
    local current = redis.call('INCR', key)
    if current == 1 then
        redis.call('EXPIRE', key, window)
    end
    if current > limit then
        return 0
    end
    return 1
`)

func checkRedisRateLimit(ctx context.Context, rdb *redis.Client, key string, limit int, windowSec int) (bool, error) {
    result, err := rateLimitScript.Run(ctx, rdb, []string{key}, limit, windowSec).Int()
    return result == 1, err
} Token bucket (golang.org/x/time/rate): allows bursts up to bucket capacity, refills at a constant rate Sliding window: more accurate than fixed window, prevents burst at window boundaries Per-user rate limits are more fair than per-IP for authenticated APIs — use user ID from JWT Redis-cell (redis module) or Lua scripts for distributed rate limiting across service instances Return Retry-After header with 429 responses to help well-behaved clients back off

How do you implement rate limiting in a Go API — per user, per IP, and globally?

Use the token bucket algorithm from golang.org/x/time/rate for single-instance rate limiting. For distributed rate limiting across multiple instances, use Redis with atomic Lua scripts.

How do you implement rate limiting in a Go API — per user, per IP, and globally?

Use the token bucket algorithm from golang.org/x/time/rate for single-instance rate limiting. For distributed rate limiting across multiple instances, use Redis with atomic Lua scripts.

Scenario Questions

Follow-up Questions