Rate Limiting

Protection against denial-of-service attacks and resource exhaustion through query throttling.

Configuration

# policy.yaml
rate_limits:
  # Global default limit
  default:
    queries_per_second: 100
    queries_per_minute: 1000
    burst: 20  # Allow short bursts

  # Per-user limits
  per_user:
    app_user:
      queries_per_second: 50
      queries_per_minute: 500
    batch_user:
      queries_per_second: 200  # Higher for batch processing
      queries_per_minute: 5000

  # Per-query limits
  per_query:
    "expensive_report":
      queries_per_minute: 10  # Limit expensive queries

RATE-001PASS

Normal Query Rate

Within Limits (10 queries/sec)

for i in {1..10}; do
  psql -c "SELECT * FROM users WHERE id = $i" &
done
# All queries are processed

Normal query rates within configured limits are processed without delay.

RATE-002BLOCKED

Rate Limit Exceeded

Expected Response (after 50 queries/sec)

ERROR: Rate limit exceeded
DETAIL: User 'app_user' has exceeded 50 queries/second.
HINT: Wait before sending more queries or contact administrator.

Headers:
X-RateLimit-Limit: 50
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1706965432

When the rate limit is exceeded, queries are temporarily blocked. The response includes headers with limit information for client-side handling.

RATE-003PASS

Burst Handling

Short bursts up to the configured burst size are tolerated. The ALG uses a token bucket algorithm that allows brief traffic spikes while preventing sustained overload.

RATE-004BLOCKED

Expensive Query Limit

After 10 Report Queries/Minute

ERROR: Query-specific rate limit exceeded
DETAIL: Query 'expensive_report' limited to 10/minute.
HINT: This query is resource-intensive. Space out requests or use batch APIs.

Expensive queries (reports, aggregations) can have lower limits than general queries to protect database resources.