API & Microservices Architecture

"""Sliding window rate limiter using Redis sorted sets."""
import time
import redis

r = redis.Redis(host="localhost", port=6379, decode_responses=True)

def is_rate_limited(client_id: str, max_requests: int = 100, window_sec: int = 60) -> bool:
    """Returns True if the client has exceeded their rate limit."""
    key = f"ratelimit:{client_id}"
    now = time.time()
    window_start = now - window_sec

    pipe = r.pipeline()
    # Remove expired entries
    pipe.zremrangebyscore(key, 0, window_start)
    # Add current request
    pipe.zadd(key, {f"{now}": now})
    # Count requests in window
    pipe.zcard(key)
    # Set TTL so keys auto-expire
    pipe.expire(key, window_sec)
    results = pipe.execute()

    request_count = results[2]
    return request_count > max_requests

# Usage in Flask middleware:
@app.before_request
def check_rate_limit():
    client_id = request.headers.get("X-API-Key", request.remote_addr)
    if is_rate_limited(client_id, max_requests=100, window_sec=60):
        return jsonify({"error": "rate_limit_exceeded"}), 429

# Kong declarative config — security plugins
_format_version: "3.0"

services:
  - name: backend-api
    url: http://api-server:8080
    routes:
      - name: api-route
        paths: ["/api/v1"]
        strip_path: false

plugins:
  # JWT authentication
  - name: jwt
    config:
      claims_to_verify: ["exp"]
      key_claim_name: "kid"
      secret_is_base64: false

  # Rate limiting (sliding window)
  - name: rate-limiting-advanced
    config:
      limit: [100]
      window_size: [60]
      identifier: consumer
      sync_rate: 10
      strategy: sliding
      namespace: api-v1

  # Request size limiting (prevent DoS)
  - name: request-size-limiting
    config:
      allowed_payload_size: 1  # 1 MB max

  # CORS
  - name: cors
    config:
      origins: ["https://app.example.com"]
      methods: ["GET", "POST", "PUT", "DELETE"]
      headers: ["Authorization", "Content-Type"]
      max_age: 3600

  # IP restriction for admin endpoints
  - name: ip-restriction
    route: admin-route
    config:
      allow: ["10.0.0.0/8"]
      deny: []