A dead simple rate limit middleware for Go with a store-based approach and support for multiple HTTP frameworks.
Limiter is a rate limiting library for Go applications designed to be straightforward and flexible. It provides middleware for popular HTTP frameworks to control request frequency and prevent abuse by returning HTTP 429 status codes when limits are exceeded.
Go developers building web services or APIs that need to implement rate limiting to prevent abuse, especially those using frameworks like Gin, Echo, Chi, Beego, or standard HTTP/FastHTTP.
Developers choose Limiter for its simple API, clean separation of rate limiting logic from storage backends, and support for both Redis and in-memory stores with ready-to-use middleware for multiple frameworks.
Dead simple rate limit middleware for Go.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The API is minimal and easy to integrate, with a five-step setup process and a formatted rate string like '1000-H' for quick configuration, as shown in the usage examples.
Decouples rate logic from storage, supporting both Redis for distributed systems and an in-memory store with automatic cleanup, allowing easy swaps based on deployment needs.
Includes ready-to-use middleware for popular Go frameworks like Gin, Echo, Chi, and FastHTTP, reducing boilerplate code for common use cases.
Offers options for client IP resolution behind reverse proxies, with support for custom headers like 'CF-Connecting-IP' and warnings about security implications, as detailed in the README.
Unlike alternatives like Throttled, Limiter lacks built-in burst rate limiting, which means it cannot allow temporary spikes in requests after limits are exceeded, a feature some applications require.
It uses a simple fixed-window algorithm without support for more complex methods like sliding windows or GCRA, which can lead to less precise rate control in high-traffic scenarios.
Handling reverse proxies requires manual configuration and security awareness, with the README admitting that header-based IP resolution is unreliable and needs custom KeyGetter implementations for robust setups.