Cybersecurity-Projects/PROJECTS/advanced/api-rate-limiter/README.md

███████╗ █████╗ ███████╗████████╗ █████╗ ██████╗ ██╗     ██╗  ██╗██████╗  ██████╗
██╔════╝██╔══██╗██╔════╝╚══██╔══╝██╔══██╗██╔══██╗██║     ██║  ██║╚════██╗██╔═████╗
█████╗  ███████║███████╗   ██║   ███████║██████╔╝██║     ███████║ █████╔╝██║██╔██║
██╔══╝  ██╔══██║╚════██║   ██║   ██╔══██║██╔═══╝ ██║     ╚════██║██╔═══╝ ████╔╝██║
██║     ██║  ██║███████║   ██║   ██║  ██║██║     ██║          ██║███████╗╚██████╔╝
╚═╝     ╚═╝  ╚═╝╚══════╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝          ╚═╝╚══════╝ ╚═════╝

Enterprise rate limiting for FastAPI using HTTP 420 "Enhance Your Calm".

Learning Docs are here: learn modules.

What It Does

• Three implementation methods: middleware (global), decorator (per route), dependency injection
• Sliding Window, Token Bucket, and Fixed Window rate limiting algorithms
• Redis support with automatic in-memory fallback when Redis is unavailable
• Scoped rate limiters for applying different limits to endpoint groups
• Fingerprint levels (RELAXED, NORMAL, STRICT) for client identification granularity
• Multiple stacking rules where the most restrictive limit applies

Quick Start

uv add fastapi-420

from fastapi import FastAPI
from fastapi_420 import RateLimiter, RateLimiterSettings

app = FastAPI()
limiter = RateLimiter(RateLimiterSettings(default_limit="69/minute"))
app.add_middleware(limiter.middleware)

For Redis support: uv add fastapi-420[redis]

[!TIP] This project uses just as a command runner. Type just to see all available commands.

Install: curl -sSf https://just.systems/install.sh | bash -s -- --to ~/.local/bin

Learn

This project includes step-by-step learning materials covering security theory, architecture, and implementation.

Module	Topic
00 - Overview	Prerequisites and quick start
01 - Concepts	Security theory and real-world breaches
02 - Architecture	System design and data flow
03 - Implementation	Code walkthrough
04 - Challenges	Extension ideas and exercises

License

AGPL 3.0