實(shí)現(xiàn)Go網(wǎng)絡(luò)服務(wù)的速率限制可通過三種方法：1.使用全局限流器，適用於輕量級(jí)服務(wù)保護(hù)；2.基於IP或API密鑰的用戶級(jí)限流，需用map存儲(chǔ)限流器；3.分佈式系統(tǒng)中使用Redis進(jìn)行跨實(shí)例限流。全局限流通過golang.org/x/time/rate包實(shí)現(xiàn)簡(jiǎn)單但不區(qū)分用戶；用戶級(jí)限流可按IP或API鍵區(qū)分但內(nèi)存消耗大；Redis方案適合多實(shí)例環(huán)境，具備持久化和擴(kuò)展性但依賴外部服務(wù)。根據(jù)需求可單獨(dú)使用或組合應(yīng)用這些策略以提供分層保護(hù)。

You can implement rate limiting in a Go web service using middleware, and there are several effective ways to do it depending on your needs—whether you're going for simplicity, per-user control, or distributed systems support.

Basic Middleware with a Global Limiter

A simple way to get started is by applying a global rate limiter that limits all incoming requests. This works well for lightweight services where you don't need per-user tracking.

You can use the standard library's golang.org/x/time/rate package:

 import "golang.org/x/time/rate"

Create a limiter like this:

 limiter := rate.NewLimiter(10, 5) // 10 requests per second, burst of 5

Then wrap your HTTP handler with middleware that checks the limiter:

 func limit(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if limiter.Allow() {
            next.ServeHTTP(w, r)
        } else {
            http.Error(w, http.StatusText(http.StatusTooManyRequests), http.StatusTooManyRequests)
        }
    })
}

Wrap your routes like this:

 http.Handle("/api", limit(myHandler))

• ? Simple and fast to set up
• ? Not user-specific
• ? Doesn't handle bursts well unless you tune the burst size

This method is great if you just want to protect your server from sudden traffic spikes without worrying about individual clients.

Per-User Rate Limiting Using IP or API Keys

If you need to track different users separately (eg, based on their IP address or an API key), you'll need a registry of limiters. You can store them in a map and use middleware to look up or create a limiter for each user.

Here's a basic version using IPs:

 var limiters = make(map[string]*rate.Limiter)
var mu sync.Mutex

func getLimiter(ip string) *rate.Limiter {
    mu.Lock()
    defer mu.Unlock()

    limiter, exists := limiters[ip]
    if !exists {
        limiter = rate.NewLimiter(5, 2) // 5 per second, burst of 2
        limiters[ip] = limiter
    }
    return limiter
}

In your middleware:

 func ipLimit(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        ip, _, _ := net.SplitHostPort(r.RemoteAddr)
        if !getLimiter(ip).Allow() {
            http.Error(w, "Too many requests", http.StatusTooManyRequests)
            return
        }
        next.ServeHTTP(w, r)
    })
}

• ? Supports per-user limits
• ?? Memory usage grows with number of users
• ?? No persistence across restarts
• ?? May not work well behind proxies unless you parse X-Forwarded-For

To improve reliability:

• Use a cache with TTL to auto-clean unused limiters
• Consider hashing or truncating IPs if privacy is a concern

Distributed Systems: External Storage with Redis

If you're running multiple instances of your service, in-memory limiters won't be enough. In this case, you can use Redis with a sliding window algorithm or token bucket implementation.

Use a Redis-based library like github.com/go-redis/redis and something like the following logic:

• Store request timestamps per user in a sorted set
• Remove timestamps older than your time window
• Count how many entries remain
• If over the limit, deny access

Alternatively, use Lua scripts to ensure atomic operations and avoid race conditions.

There are also packages like github.com/ulule/limiter that abstract this complexity and support Redis out of the box.

Example config:

 store, err := redis.NewStore(redis.Options{
    Addr: "localhost:6379",
})

Then define a rate (like "10-S" for 10 per second):

 rate, _ := limiter.NewRateFromFormatted("10-S")
instance := limiter.New(store, rate)

Middleware becomes:

 handler := limiter.HTTPMiddleware(instance, func(w http.ResponseWriter, r *http.Request) {
    // your actual handler here
})

• ? Works across multiple instances
• ? Persistent and scalable
• ? Adds dependency on Redis
• ? Slightly more complex setup

Depending on your needs, you might go with one or combine strategies. For example, a global rate limiter plus per-user ones gives you layered protection.

基本上就這些。

以上是如何在Golang Web服務(wù)中實(shí)施限制速率的詳細(xì)內(nèi)容。更多資訊請(qǐng)關(guān)注PHP中文網(wǎng)其他相關(guān)文章！