👀 Views: 0 💬 Answers: 1 📅 Created: 2025-09-01

spring-boot redis rate-limiting Java

I'm currently implementing rate limiting for my Spring Boot REST API using a token bucket algorithm backed by Redis. My setup uses Spring Data Redis (version 2.5.0) to manage the token bucket state, but I'm running into inconsistent behavior across different endpoints. Sometimes, requests are being throttled correctly, while at other times they exceed the rate limit, resulting in unexpected 429 Too Many Requests responses. Here's a snippet of my rate limiting filter: ```java @Component public class RateLimitingFilter extends OncePerRequestFilter { @Autowired private StringRedisTemplate redisTemplate; private final int limit = 10; // 10 requests private final long timeWindow = 60; // 60 seconds @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { String ip = request.getRemoteAddr(); String key = "rate_limit:" + ip; Long currentTokens = redisTemplate.opsForValue().increment(key, 1); if (currentTokens == 1) { redisTemplate.expire(key, timeWindow, TimeUnit.SECONDS); } if (currentTokens > limit) { response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value()); return; } filterChain.doFilter(request, response); } } ``` I've ensured that the Redis connection is stable and set up for high availability. However, I noticed that during peak hours, the rate limiting can allow bursts of traffic beyond the specified limit. I've tried increasing the token bucket capacity and time window, but it hasn't resolved the issue. I've also enabled logging for the request counts but they seem to show a correct increase. Could there be a concurrency issue with how the Redis increments are being managed? Or might I be missing an aspect regarding how requests are handled in Spring Boot under load? Any insights would be greatly appreciated!