Request to support rate limit mechanism

[JohnNiang]

Your current Halo version

2.7.0-SNAPSHOT

Describe this feature

Currently, everyone can request all APIs without limit, such as login and comments APIs, which is very dangerous and provides opportunity for brute-force attack and injecting large amounts of invalid data.

Learn more about RateLimit, please refer to

• https://en.wikipedia.org/wiki/Rate_limiting
• https://www.cloudflare.com/learning/bots/what-is-rate-limiting/
• https://platform.openai.com/docs/guides/rate-limits/overview
• https://github.com/resilience4j/resilience4j
• https://github.com/bucket4j/bucket4j

Additional information

/kind feature
/area core

[guqing]

目前 halo 本身就是引入了google guava 的可以直接使用 guava 提供的 RateLimiter https://github.com/google/guava/blob/master/guava/src/com/google/common/util/concurrent/RateLimiter.java

[JackyLiang522]

/assign

[JackyLiang522]

Hi! I have tried adding a login rate limiter with google guava. Does it look correct?
https://github.com/halo-dev/halo/compare/main...JustinLiang522:issue4044?expand=1

[JohnNiang]

Hi! I have tried adding a login rate limiter with google guava. Does it look correct? https://github.com/halo-dev/halo/compare/main...JustinLiang522:issue4044?expand=1

Thanks for your investigation!

But I have three questions to the implementation:

1. Is the limiter blocking operation?
   If it it, the operation may block the non-blocking threads to serve requests. Please refer to https://projectreactor.io/docs/core/release/reference/#_blocking_can_be_wasteful.
2. Should we distinguish IP address in the rate limiter?
3. Finally, what if we need to deal with other APIs?

Would love to hear your feedback.

[JackyLiang522]

Thank you for your advice!

Based on the implementation of Guava Rate Limiter, it is not a blocking operation. In the codes, the tryAcquire is called with timeout=0, so it will not block the thread.

For question 2 and 3. I think we can define a ApiRateLimiter class like below, which includes an object to map users' IP addresses to rate limiters. This class can be used whenever needed.

public class ApiRateLimiter {
    private final Map<String, RateLimiter> rateLimiterMap = new HashMap<>();
    private final double rate;

    public ApiRateLimiter(double rate) {
        this.rate = rate;
    }

    public boolean tryAcquire(String clientIpAddress) {
        if (rateLimiterMap.containsKey(clientIpAddress)) {
            return rateLimiterMap.get(clientIpAddress).tryAcquire();
        } else {
            var rateLimiter = RateLimiter.create(rate);
            rateLimiterMap.put(clientIpAddress, rateLimiter);
            return rateLimiter.tryAcquire();
        }
    }
}

[JohnNiang]

I also made a simple implementation about Rate Limit mechanism using https://github.com/resilience4j/resilience4j. Please see https://github.com/halo-dev/halo/compare/main...JohnNiang:halo:feat/rate-limit?expand=1 for more.

Why should I choose the resilience4j?

1. It integrates with Spring Boot 3, which can let us configure Rate Limit in application.yaml instead of changing code directly.
2. It provides a module with custom Spring Reactor operators. So that we can integrate it into Halo easily.
3. We can easily can override the in-memory RateLimiterRegistryStore by a custom implementation.
4. It allows us use Ehcache, Caffeine, Redisson, Hazelcast, Ignite or other JCache implementation as Cache Manager for the RateLimiterRegistryStore.

[JackyLiang522]

I also made a simple implementation about Rate Limit mechanism using https://github.com/resilience4j/resilience4j. Please see https://github.com/halo-dev/halo/compare/main...JohnNiang:halo:feat/rate-limit?expand=1 for more.

Your code looks complete and well-structured. I am not sure if there is still any part that I can contribute to at this point. I would be happy to help in any way I can.

[guqing]

/milestone 2.7.x

[JohnNiang]

Your code looks complete and well-structured. I am not sure if there is still any part that I can contribute to at this point. I would be happy to help in any way I can.

Hi @JustinLiang522 , I will try to implement rate limit for login endpoint, and you can have a try on comment endpoint.

/assign