implement API rate limiter and throttling#17
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds Django REST Framework throttling to protect key QueueLess API endpoints (queue join + polling-style endpoints) and introduces custom throttle scopes intended to cap burst traffic and joins.
Changes:
- Added global DRF throttling configuration (daily anon/user quotas + scoped rates) in
settings.py. - Introduced
JoinQueueRateThrottle/BurstRateThrottleand applied them to queue join/status/check-in/cancel endpoints. - Added a scratch throttling “test” script.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| scratch/test_throttling.py | Adds a script-like throttling check, currently named/structured like a pytest test. |
| queueless_backend/queueless_backend/settings.py | Configures DRF default throttles/rates (daily quotas + join/burst rates). |
| queueless_backend/queue_tracker/views.py | Applies join/burst throttles to public queue endpoints. |
| queueless_backend/queue_tracker/throttles.py | Defines two throttle classes with join and burst scopes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…ated verification
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "DEFAULT_THROTTLE_RATES": { | ||
| "anon": os.getenv("DRF_THROTTLE_RATE_ANON", "20000/day"), | ||
| "user": os.getenv("DRF_THROTTLE_RATE_USER", "100000/day"), | ||
| "burst": os.getenv("DRF_THROTTLE_RATE_BURST", "60/minute"), | ||
| "join": os.getenv("DRF_THROTTLE_RATE_JOIN", "5/minute"), | ||
| }, |
| REST_FRAMEWORK = { | ||
| "DEFAULT_THROTTLE_CLASSES": [ | ||
| "rest_framework.throttling.AnonRateThrottle", | ||
| "rest_framework.throttling.UserRateThrottle", | ||
| "rest_framework.throttling.ScopedRateThrottle", | ||
| ], |
| class QueueEntryCheckInView(APIView): | ||
| permission_classes = [permissions.AllowAny] | ||
| throttle_scope = "burst" | ||
|
|
||
| def patch(self, request, session_id): |
| class QueueEntryCancelView(APIView): | ||
| permission_classes = [permissions.AllowAny] | ||
| throttle_scope = "burst" | ||
|
|
||
| def post(self, request, session_id): |
This PR introduces a robust rate-limiting (throttling) layer to the QueueLess API to protect against spam, brute-force joins, and aggressive polling. By implementing this, we ensure system stability even during high-traffic spikes and prevent individual users from monopolizing server resources.
Key Changes
Multi-Layer Throttling
Architectural Cleanliness
Load Balancer Ready
Testing Done
Test Results:
Ran 3 tests in 0.210s
OK
How to Test