Subject: [httpapi] Standardizing RateLimit headers

From: Roberto Polli <[email-masked]>
Date: Wed, 21 Oct 2020 23:57:56 +0200

Hi @all,

I'm glad that this workgroup started working, and this is my first
contribution.

In the past months, me and Alex (in CC) worked on this I-D to standardize
`RateLimit-*` headers.

The document defines the RateLimit-Limit, RateLimit-Remaining,
RateLimit-Reset header fields for HTTP, thus allowing servers to
publish current request quotas and clients to shape their request
policy avoiding being throttled out.

The draft is here:

-  https://tinyurl.com/draft-ratelimit-html

And here some slides:

-
https://docs.google.com/presentation/d/18RWq_XYfKHf2E5TTCAc5xx9rgdIZgrN0tfB0jmVlnSM/edit#slide=id.p

This draft has been implemented by:
- Red Hat 3scale
- Kong
- Armeria Java API framework
- express-rate-limit
- Envoy proxy (almost done)

Other implementers (Eg. Traefik) are interested in the I-D but are waiting
for an official RFC before investing in the implementation,
so it would be great to discuss that in the workgroup.

Have a nice day,
R.

---

From: Alex Martinez <[email-masked]>
Date: Thu, 22 Oct 2020 08:24:10 +0000

Hi André,

On Thu, Oct 22, 2020 at 8:10 AM André Cedik <[email-masked]>
wrote:

> One additional thing we are doing is we are returning a fourth header
> called RateLimit-Interval that returns the standard time-window.
>
> So when you get the basic response for a single request e.g.
>
> RateLimit-Limit: 100
> RateLimit-Remaining: 99
> RateLimit-Reset: 59
>
> a client wouldn't know that actually, a second has passed between the
> request and setting the header field.
>
> By returning the RateLimit-Interval field the client is able to adjust
> their request window which is something that you are already providing for
> other request limit windows by making it possible to add them in the
> RateLimit-Limit header. I don't know if having a fourth header is the best
> way to do this, since you could also provide this information by adjusting
> the basic value of the RateLimit-Limit header like this:
>
> RateLimit-Limit: 100;w=60
>
>
> Is this possible?
>

I think what you are looking for is covered in Section 3.1 of the draft
under the associated time-window for RateLimit-Limit, so no additional
header is needed. If not, it would be great to share more details about
your use case.

Cheers,
  Alex

---

From: Roberto Polli <[email-masked]>
Date: Thu, 22 Oct 2020 11:53:18 +0200

Hi André,

Il giorno gio 22 ott 2020 alle ore 10:24 Alex Martinez <[email-masked]> ha
>> [..] you could also provide this information by adjusting the basic
value of the RateLimit-Limit header like this:
> I think what you are looking for is covered in Section 3.1
> If not, it would be great to share more details about your use case.
just for completeness, from Section 3.1
https://ioggstream.github.io/draft-polli-ratelimit-headers/draft-polli-ratelimit-headers.html#name-ratelimit-limit

```
 A time-window associated to expiring-limit can be communicated via an
optional quota-policy value, like shown in the following example

   RateLimit-Limit: 100, 100;w=10
```

This allows "lazy/old" parsers to be able to process the first item as an
integer, and ignore everything after the comma.

Let us know,
R: