Rate limit per JWT claim

[brunobastosg]

We have a use-case where different clients have a different number of requests they can make to the API.

We implemented this in our custom KrakenD build, but I'm opening this PR in case you're interested.

Basically, we added a tierConfiguration block under github.com/devopsfaith/krakend-ratelimit/juju/router's extra_config:

EDIT (18/05/2021): I changed the config file format to accept IP/header as client identifier (as the regular client max rate does) and use a header to identify tier as suggested in the discussion below.

"tierConfiguration": {
  "headerTier": "x-tier",
  "strategy": "header",
  "key": "x-user",
  "duration": "24h",
  "tiers": [
    {
      "name": "unlimited",
      "limit": 0
    },
    {
      "name": "gold",
      "limit": 50000
    },
    {
      "name": "silver",
      "limit": 20000
    },
    {
      "name": "bronze",
      "limit": 5000
    }
  ]
}

The original format I suggested was:

"tierConfiguration": {
  "jwtClaim": "tier",
  "duration": "24h",
  "tiers": [
    {
      "name": "unlimited",
      "limit": 0
    },
    {
      "name": "gold",
      "limit": 50000
    },
    {
      "name": "silver",
      "limit": 20000
    },
    {
      "name": "bronze",
      "limit": 5000
    }
  ]
}

In the example above, a client in the gold tier can make 50k requests per day, and so on.

[kpacha]

Hi, @brunobastosg

this is a great idea! I think we could add it to the project with some little changes.

please, check out my comments on the code

[kpacha]

instead of using a simple map, why don't you go with a sharded store (https://github.com/devopsfaith/krakend-ratelimit/blob/master/krakendrate.go#L52) ?

[brunobastosg]

I'll look into it.

[brunobastosg]

Done.

[alombarte]

hi, there is a map without a mutex. There is a good implementation on the link above.

[brunobastosg]

Hi, you commented on an outdated version. What do you mean? I'm using a ShardedMemoryBackend.