Use rate.Limiter to realize the basic current limiting based on token bucket algorithm, and block the waiting token through the Wait() method to ensure that the number of requests processed per second does not exceed the set value; 2. Use the Allow() method to check whether the request is released without blocking, which is suitable for quickly rejecting over-limit requests and returning 429 status codes; 3. The current limiter can be integrated into HTTP middleware to achieve global current limiting, and the rate of all requests is unified; 4. Use map to combine sync.RWMutex to independently maintain the current limiter for each IP or user to achieve fine-grained current limiting; it is necessary to note that long-term unused current limiter instances should be cleaned regularly in the production environment to avoid memory leakage. Go's rate package is simple and efficient, and is easy to integrate into various services.

Implementing Rate Limiting in the Go language is a common requirement, especially in the construction of API services, crawlers, microservice gateways and other scenarios. Go's standard library provides simple and powerful tools to implement current limiting, and the most commonly used is golang.org/x/time/rate package.

The following is a few typical examples to help you understand how to achieve current limiting in Go step by step.

1. Use rate.Limiter to implement basic current limiting

rate.Limiter is a current limiter officially recommended by Go, and is implemented based on the token bucket algorithm (Token Bucket) .

 package main

import (
    "fmt"
    "time"
    "golang.org/x/time/rate"
)

func main() {
    // Allow 3 requests per second (one token per 333ms), and hold up to 5 tokens (burst=5)
    limiter := rate.NewLimiter(3, 5)

    for i := 0; i < 10; i {
        // Wait until there are enough tokens limiter.Wait(nil) // nil means the default context is used (cancel is not supported)

        fmt.Printf("Processing request %d, time: %s\n", i 1, time.Now().Format("15:04:05.000"))
    }
}

Output example:

 Processing request 1, time: 10:00:00.000
Processing request 2, time: 10:00:00.333
Processing request 3, time: 10:00:00.666
Processing request 4, time: 10:00:01.000
...

? Description: Up to 3 requests are processed per second, and the exceeded requests will be blocked and waited until the token is available.

2. Non-blocking check: Use Allow() to determine whether to release it

If you don't want to block requests (such as quick rejection in the Web API), you can use the Allow() method:

 package main

import (
    "fmt"
    "time"
    "golang.org/x/time/rate"
)

func main() {
    limiter := rate.NewLimiter(2, 3) // 2 per second, burst 3

    for i := 0; i < 10; i {
        if limiter.Allow() {
            fmt.Printf("? Request %d is allowed, time: %s\n", i 1, time.Now().Format("15:04:05.000"))
        } else {
            fmt.Printf("? Request %d is denied\n", i 1)
        }
        time.Sleep(200 * time.Millisecond) // Simulation request arrives}
}

Output example:

 ? Request 1 is allowed, time: 10:00:00.000
? Request 2 is allowed, time: 10:00:00.200
? Request 3 is allowed, time: 10:00:00.400
? Request 4 Denied ? Request 5 is allowed, time: 10:00:00.800
...

? Suitable for API current limiting, directly return to 429 Too Many Requests.

3. Combining HTTP services to achieve global stream limit

You can put rate.Limiter in the middleware to limit the current flow to all requests:

 package main

import (
    "net/http"
    "golang.org/x/time/rate"
    "time"
    "fmt"
)

var limiter = rate.NewLimiter(1, 5) // 1 time per second, 5 bursts func limit(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        if !limiter.Allow() {
            http.Error(w, "Too Many Requests", http.StatusTooManyRequests)
            Return
        }
        next(w, r)
    }
}

func handler(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintf(w, "Hello! Time: %s", time.Now().Format("15:04:05"))
}

func main() {
    http.HandleFunc("/", limit(handler))
    http.ListenAndServe(":8080", nil)
}

? Visit http://localhost:8080 , and if it exceeds 1 time per second, it will return 429 .

4. Current limit by user/IP (based on map current limiter)

A more practical scenario is to limit current by user or IP . You can use map to store the current limiter for each user and lock protection:

 package main

import (
    "net/http"
    "sync"
    "golang.org/x/time/rate"
    "time"
    "fmt"
)

type IPRateLimiter struct {
    visitors map[string]*rate.Limiter
    mu sync.RWMutex
}

func NewIPRateLimiter(r rate.Limit, b int) *IPRateLimiter {
    return &IPRateLimiter{
        visitors: make(map[string]*rate.Limiter),
        mu: sync.RWMutex{},
    }
}

func (i *IPRateLimiter) Add(ip string) *rate.Limiter {
    i.mu.Lock()
    defer i.mu.Unlock()

    limiter := rate.NewLimiter(r, b)
    i.visitors[ip] = limiter
    return limiter
}

func (i *IPRateLimiter) Get(ip string) *rate.Limiter {
    i.mu.Lock()
    defer i.mu.Unlock()

    limiter, exists := i.visitors[ip]
    if !exists {
        return nil
    }
    return limiter
}

func (i *IPRateLimiter) Limit(next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        ip := r.RemoteAddr // In practice, it is recommended to use X-Forwarded-For or Real-IP
        limiter := i.Get(ip)
        if limiter == nil {
            limiter = i.Add(ip)
        }

        if !limiter.Allow() {
            http.Error(w, "Too Many Requests", http.StatusTooManyRequests)
            Return
        }
        next(w, r)
    }
}

func main() {
    limiter := NewIPRateLimiter(2, 5) // 2 times per second, burst 5

    http.HandleFunc("/", limiter.Limit(func(w http.ResponseWriter, r *http.Request) {
        fmt.Fprintf(w, "Hello from %s", r.RemoteAddr)
    }))

    http.ListenAndServe(":8080", nil)
}

? Each IP is independently limited in flow, suitable for preventing crawlers or abuse.

Summary: Key points

• rate.Limiter is the official recommended current limiting tool by Go.
• Wait() : Blocking waiting tokens, suitable for background tasks.
• Allow() : Non-blocking judgment, suitable for web interfaces.
• Limit the current by IP/user: Use map sync.RWMutex to manage multiple current limiters.
• Note: Memory cleaning should be considered in the production environment (such as regularly deleting IP records that are not used for a long time).

Basically that's it. Go's rate package is simple and efficient, and it is easy to integrate into the project with middleware. Not complicated, but it is easy to ignore details such as concurrent security and burst settings.

The above is the detailed content of go by example rate limiting. For more information, please follow other related articles on the PHP Chinese website!