Use golang.org/x/time/rate to implement basic IP-based current limits, and apply 5 requests per second and 10 bursts per second to each client through middleware; 2. Clear long-term inactive client entries by starting a regular cleaning of goroutine to avoid memory leaks; 3. Use a custom structure containing current limiters and last access time to improve tracking accuracy; 4. In production environments, you should consider using Redis to implement distributed current limits, API key-based identity recognition, hierarchical current limit policies and return standard current limit response headers such as X-RateLimit-Limit and Retry-After.
Implementing a rate limiter in a Go API is a practical way to protect your backend from abuse, ensure fair usage, and maintain system stability. While Go doesn't include a built-in rate limiter in the standard library, it's straightforward to build one using packages like golang.org/x/time/rate or implement custom logic with middleware.
Here's how you can effectively implement a rate limiter in a Go-based HTTP API.
1. Using golang.org/x/time/rate for Basic Rate Limiting
The rate package provides a simple and efficient token bucket implementation. You can wrap it in middleware to apply limits per request.
First, install the package:
go get golang.org/x/time/rate
Then, create a middleware function:
package main
import (
"net/http"
"time"
"golang.org/x/time/rate"
)
// Create a map to hold rate limiters for each client (eg, by IP)
var visitors = make(map[string]*rate.Limiter)
var mu sync.RWMutex // protect the map
// GetVisitorLimiter returns a rate limiter for the provided IP address
func getVisitorLimiter(ip string) *rate.Limiter {
mu.Lock()
defer mu.Unlock()
limiter, exists := visitors[ip]
if !exists {
// Allow 5 requests per second, with a burst of 10
limiter = rate.NewLimiter(5, 10)
visitors[ip] = limiter
}
return limiter
}
// RateLimit is middleware that limits requests based on client IP
func rateLimit(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
ip := r.RemoteAddr // Consider using X-Forwarded-For in production
limiter := getVisitorLimiter(ip)
if !limiter.Allow() {
http.Error(w, "Rate limit exceeded", http.StatusTooManyRequests)
Return
}
next.ServeHTTP(w, r)
})
}Apply it to your routes:
func main() {
mux := http.NewServeMux()
mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
w.Write([]byte("Hello, rate-limited world!"))
})
http.ListenAndServe(":8080", rateLimit(mux))
}This setup limits each unique IP to 5 requests per second, with bursts up to 10.
2. Enhancing with Cleanup to Avoid Memory Leaks
Since the visitors map grows indefinitely, you should clean up old entries. Add a background cleanup goroutine:
func cleanupVisitors() {
for {
time.Sleep(time.Minute)
mu.Lock()
for ip, limiter := range visitors {
if limiter.Tokens() == 10 && limiter.Limit() == 5 {
// If idle and at full capacity, assume inactive
delete(visitors, ip)
}
}
mu.Unlock()
}
}
func main() {
go cleanupVisitors() // Start cleanup routine
// ... rest of setup
}Note: This is a basic heuristic. You might instead track last-seen timestamps for more accuracy.
3. Using a Custom Struct for Better Tracking
For more control, encapsulate the limiter and last seen time:
type client struct {
limiter *rate.Limiter
lastSeen time.Time
}
var clients = make(map[string]*client)
var clMu sync.RWMutex
func getClientLimiter(ip string) *rate.Limiter {
clMu.Lock()
defer clMu.Unlock()
c, exists := clients[ip]
if !exists {
c = &client{
limiter: rate.NewLimiter(5, 10),
lastSeen: time.Now(),
}
clients[ip] = c
} else {
c.lastSeen = time.Now()
}
return c.limiter
}
// Background cleanup
func cleanupClients() {
for {
time.Sleep(5 * time.Minute)
clMu.Lock()
for ip, c := range clients {
if time.Since(c.lastSeen) > 10*time.Minute {
delete(clients, ip)
}
}
clMu.Unlock()
}
} Start the cleanup: go cleanupClients() in main() .
4. Considerations for Production Use
While the above works for small to medium APIs, production systems may need:
- Distributed rate limiting : Use Redis with algorithms like sliding window or token bucket (eg, with
go-redis/redis_rate). - Better identity tracking : Use API keys or JWTs instead of IPs (which can be shared or spoofed).
- Tiered limits : Different limits for free vs. premium users.
- Header feedback : Return
Retry-After,X-RateLimit-Limit,X-RateLimit-Remaining.
Example headers:
if !limiter.Allow() {
w.Header().Set("X-RateLimit-Limit", "5")
w.Header().Set("X-RateLimit-Remaining", "0")
w.Header().Set("Retry-After", "1")
http.Error(w, "Rate limit exceeded", http.StatusTooManyRequests)
Return
}Summary
You can implement a basic but effective rate limiter in Go using:
-
golang.org/x/time/ratefor the core logic - Middleware to wrap HTTP handlers
- A map (with mutex) to track per-client limiters
- Periodic cleanup to avoid memory bloat
For production, consider moving to Redis-backed solutions and more robust client identification.
Basically, it's simple to get started — but scaling it requires attention to cleanup, identity, and distribution.
The above is the detailed content of Implementing a Rate Limiter in a Go API. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undress AI Tool
Undress images for free
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Is golang frontend or backend
Jul 08, 2025 am 01:44 AM
Golang is mainly used for back-end development, but it can also play an indirect role in the front-end field. Its design goals focus on high-performance, concurrent processing and system-level programming, and are suitable for building back-end applications such as API servers, microservices, distributed systems, database operations and CLI tools. Although Golang is not the mainstream language for web front-end, it can be compiled into JavaScript through GopherJS, run on WebAssembly through TinyGo, or generate HTML pages with a template engine to participate in front-end development. However, modern front-end development still needs to rely on JavaScript/TypeScript and its ecosystem. Therefore, Golang is more suitable for the technology stack selection with high-performance backend as the core.
How to build a GraphQL API in golang
Jul 08, 2025 am 01:03 AM
To build a GraphQLAPI in Go, it is recommended to use the gqlgen library to improve development efficiency. 1. First select the appropriate library, such as gqlgen, which supports automatic code generation based on schema; 2. Then define GraphQLschema, describe the API structure and query portal, such as defining Post types and query methods; 3. Then initialize the project and generate basic code to implement business logic in resolver; 4. Finally, connect GraphQLhandler to HTTPserver and test the API through the built-in Playground. Notes include field naming specifications, error handling, performance optimization and security settings to ensure project maintenance
How to install Go
Jul 09, 2025 am 02:37 AM
The key to installing Go is to select the correct version, configure environment variables, and verify the installation. 1. Go to the official website to download the installation package of the corresponding system. Windows uses .msi files, macOS uses .pkg files, Linux uses .tar.gz files and unzip them to /usr/local directory; 2. Configure environment variables, edit ~/.bashrc or ~/.zshrc in Linux/macOS to add PATH and GOPATH, and Windows set PATH to Go in the system properties; 3. Use the government command to verify the installation, and run the test program hello.go to confirm that the compilation and execution are normal. PATH settings and loops throughout the process
Go sync.WaitGroup example
Jul 09, 2025 am 01:48 AM
sync.WaitGroup is used to wait for a group of goroutines to complete the task. Its core is to work together through three methods: Add, Done, and Wait. 1.Add(n) Set the number of goroutines to wait; 2.Done() is called at the end of each goroutine, and the count is reduced by one; 3.Wait() blocks the main coroutine until all tasks are completed. When using it, please note: Add should be called outside the goroutine, avoid duplicate Wait, and be sure to ensure that Don is called. It is recommended to use it with defer. It is common in concurrent crawling of web pages, batch data processing and other scenarios, and can effectively control the concurrency process.
Go embed package tutorial
Jul 09, 2025 am 02:46 AM
Using Go's embed package can easily embed static resources into binary, suitable for web services to package HTML, CSS, pictures and other files. 1. Declare the embedded resource to add //go:embed comment before the variable, such as embedding a single file hello.txt; 2. It can be embedded in the entire directory such as static/*, and realize multi-file packaging through embed.FS; 3. It is recommended to switch the disk loading mode through buildtag or environment variables to improve efficiency; 4. Pay attention to path accuracy, file size limitations and read-only characteristics of embedded resources. Rational use of embed can simplify deployment and optimize project structure.
Go for Audio/Video Processing
Jul 20, 2025 am 04:14 AM
The core of audio and video processing lies in understanding the basic process and optimization methods. 1. The basic process includes acquisition, encoding, transmission, decoding and playback, and each link has technical difficulties; 2. Common problems such as audio and video aberration, lag delay, sound noise, blurred picture, etc. can be solved through synchronous adjustment, coding optimization, noise reduction module, parameter adjustment, etc.; 3. It is recommended to use FFmpeg, OpenCV, WebRTC, GStreamer and other tools to achieve functions; 4. In terms of performance management, we should pay attention to hardware acceleration, reasonable setting of resolution frame rates, control concurrency and memory leakage problems. Mastering these key points will help improve development efficiency and user experience.
How to build a web server in Go
Jul 15, 2025 am 03:05 AM
It is not difficult to build a web server written in Go. The core lies in using the net/http package to implement basic services. 1. Use net/http to start the simplest server: register processing functions and listen to ports through a few lines of code; 2. Routing management: Use ServeMux to organize multiple interface paths for easy structured management; 3. Common practices: group routing by functional modules, and use third-party libraries to support complex matching; 4. Static file service: provide HTML, CSS and JS files through http.FileServer; 5. Performance and security: enable HTTPS, limit the size of the request body, and set timeout to improve security and performance. After mastering these key points, it will be easier to expand functionality.
Go select with default case
Jul 14, 2025 am 02:54 AM
The purpose of select plus default is to allow select to perform default behavior when no other branches are ready to avoid program blocking. 1. When receiving data from the channel without blocking, if the channel is empty, it will directly enter the default branch; 2. In combination with time. After or ticker, try to send data regularly. If the channel is full, it will not block and skip; 3. Prevent deadlocks, avoid program stuck when uncertain whether the channel is closed; when using it, please note that the default branch will be executed immediately and cannot be abused, and default and case are mutually exclusive and will not be executed at the same time.
