How to Implement Rate Limiting in Spring Boot APIs Using Aspect-Oriented Programming (AOP)

What I learned doing side projects…

5 min readMay 4, 2024

Introduction: Aspect-Oriented Programming (AOP) is a powerful technique in Spring Boot for separating cross-cutting concerns from the main application logic. One common use case of AOP is implementing rate limiting in APIs, where you restrict the number of requests a client can make within a certain period. In this article, we’ll explore how to leverage AOP to implement rate limiting in Spring Boot APIs, ensuring optimal performance and resource utilization.

1. Understanding Aspect-Oriented Programming (AOP)

Aspect-Oriented Programming is a programming paradigm that aims to modularize cross-cutting concerns in software development. Cross-cutting concerns are aspects of a program that affect multiple modules and are difficult to modularize using traditional approaches. Examples include logging, security, and transaction management.

AOP introduces the concept of aspects, which encapsulate cross-cutting concerns. Aspects are modular units that can be applied across different parts of the application without modifying the core logic. AOP frameworks, such as Spring AOP, provide mechanisms for defining aspects and applying them to specific join points in the application’s execution flow.

2. Implementing Rate Limiting with AOP in Spring Boot

Rate limiting is a common requirement in web APIs to prevent abuse and ensure fair usage of resources. With AOP in Spring Boot, we can implement rate limiting by intercepting method invocations and enforcing restrictions on the number of requests allowed within a certain time frame.

To implement rate limiting with AOP in Spring Boot, we typically follow these steps:

Define a custom annotation to mark methods that should be rate-limited.
Create an aspect class that intercepts method invocations annotated with the custom annotation.
Use a rate limiter component to track and enforce rate limits.
Handle rate limit exceeded scenarios gracefully, such as by throwing a custom exception.

3. Example: Rate Limiting in a Spring Boot API

Implementing rate limiting in a Spring Boot API can be achieved using various techniques. One common approach is to use Spring AOP (Aspect-Oriented Programming) to intercept incoming requests and enforce rate limits.

Step 1 - Define Rate Limiting Configuration: Create a configuration class where you define the rate limit parameters such as the number of requests allowed and the time period.

@Configuration
public class RateLimitConfig {
    @Value("${rate.limit.requests}")
    private int requests;

    @Value("${rate.limit.seconds}")
    private int seconds;

    // Getters and setters
}

Step 2 — Create a Rate Limiting Aspect: Implement an aspect using Spring AOP to intercept method calls and enforce rate limits.

@Aspect
@Component
public class RateLimitAspect {
    @Autowired
    private RateLimitConfig rateLimitConfig;

    @Autowired
    private RateLimiter rateLimiter;

    @Around("@annotation(RateLimited)")
    public Object enforceRateLimit(ProceedingJoinPoint joinPoint) throws Throwable {
        String key = getKey(joinPoint);
        if (!rateLimiter.tryAcquire(key, rateLimitConfig.getRequests(), rateLimitConfig.getSeconds())) {
            throw new RateLimitExceededException("Rate limit exceeded");
        }
        return joinPoint.proceed();
    }

    private String getKey(ProceedingJoinPoint joinPoint) {
        // Generate a unique key for the method being called
        // Example: method signature, user ID, IP address, etc.
        // You can customize this based on your requirements
    }
}

Step 3 — Define RateLimited Annotation: Create a custom annotation to mark the methods that should be rate-limited.

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
  public @interface RateLimited {
}

Step 4 — Implement Rate Limiter: Create a rate limiter component to manage rate limits using a token bucket algorithm or any other suitable algorithm.

@Component
public class RateLimiter {
    private final Map<String, RateLimitedSemaphore> semaphores = new ConcurrentHashMap<>();

    public boolean tryAcquire(String key, int requests, int seconds) {
        // Get the current timestamp
        long currentTime = System.currentTimeMillis();

        // Calculate the start time of the time window (in milliseconds)
        long startTime = currentTime - seconds * 1000;

        // Remove expired entries from the semaphore map
        cleanupExpiredEntries(startTime);

        // Get or create the semaphore for the given key
        RateLimitedSemaphore semaphore = semaphores.computeIfAbsent(key, k -> {
            RateLimitedSemaphore newSemaphore = new RateLimitedSemaphore(requests);
            newSemaphore.setLastAcquireTime(currentTime); // Set last acquire time
            return newSemaphore;
        });

        // Check if the semaphore allows acquiring a permit
        boolean acquired = semaphore.tryAcquire();
        if (acquired) {
            semaphore.setLastAcquireTime(currentTime); // Update last acquire time
        }
        return acquired;
    }

    private void cleanupExpiredEntries(long startTime) {
        Iterator<Map.Entry<String, RateLimitedSemaphore>> iterator = semaphores.entrySet().iterator();
        while (iterator.hasNext()) {
            Map.Entry<String, RateLimitedSemaphore> entry = iterator.next();
            String key = entry.getKey();
            RateLimitedSemaphore semaphore = entry.getValue();
            if (semaphore.getLastAcquireTime() < startTime) {
                iterator.remove();
            }
        }
    }

    private class RateLimitedSemaphore extends Semaphore {
        private volatile long lastAcquireTime;

        public RateLimitedSemaphore(int permits) {
            super(permits);
        }

        public long getLastAcquireTime() {
            return lastAcquireTime;
        }

        public void setLastAcquireTime(long lastAcquireTime) {
            this.lastAcquireTime = lastAcquireTime;
        }
    }
}

Step 5 — Annotate Controller Methods: Annotate the controller methods that should be rate-limited with @RateLimited.

@RestController
public class MyController {
    @RateLimited
    @GetMapping("/api/resource")
    public ResponseEntity<String> getResource() {
        // Implementation
    }
}

Step 6 — Configure Rate Limit Properties: Configure the rate limit properties in your application.properties or application.yml.

rate.limit.requests=10
rate.limit.seconds=60

Futhermore…

To limit requests by IP address, you can extract the IP address from the incoming request and use it as the key for rate limiting. Here’s how you can modify the getKey method to generate a unique key based on the IP address:

private String getKey(HttpServletRequest request) {
    // Get the IP address of the client making the request
    String ipAddress = request.getRemoteAddr();
    return ipAddress; // Use IP address as the key
}

You will also need to modify the enforceRateLimit method in the RateLimitAspect class to pass the HttpServletRequest object to the getKey method:

@Around("@annotation(RateLimited)")
public Object enforceRateLimit(ProceedingJoinPoint joinPoint) throws Throwable {
    // Get the current request from the JoinPoint
    ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
    HttpServletRequest request = requestAttributes.getRequest();

    String key = getKey(request);
    if (!rateLimiter.tryAcquire(key, rateLimitConfig.getRequests(), rateLimitConfig.getSeconds())) {
        throw new RateLimitExceededException("Rate limit exceeded");
    }
    return joinPoint.proceed();
}

In this example, we define a custom annotation @RateLimited to mark methods that should be rate-limited. We then create an aspect RateLimitAspect that intercepts method invocations annotated with @RateLimited. Inside the aspect, we enforce rate limits using a RateLimiter component.

4. Conclusion

In this article, we’ve explored how to implement rate limiting in Spring Boot APIs using Aspect-Oriented Programming (AOP). By separating cross-cutting concerns such as rate limiting from the core application logic, we can ensure better modularity, maintainability, and scalability of our applications. AOP provides a powerful mechanism for addressing such concerns, allowing developers to focus on building robust and efficient APIs.

By following the steps outlined in this article and leveraging AOP capabilities in Spring Boot, developers can easily implement rate limiting and other cross-cutting concerns in their applications, leading to more resilient and high-performing APIs.