quart-rate-limiter 0.1.0

Usage

To add a rate limit first initialise the RateLimiting extension with the application,

app = Quart(__name__)
rate_limiter = RateLimiter(app)

or via the factory pattern,

rate_limiter = RateLimiter()

def create_app():
    app = Quart(__name__)
    rate_limiter.init_app(app)
    return app

Now this is done you can apply rate limits to any route by using the rate_limit decorator,

@app.route('/')
@rate_limit(1, timedelta(seconds=10))
async def handler():
    ...

To alter the identification of remote users you can either supply a global key function when initialising the extension, or on a per route basis.

By default rate limiting information (TATs) will be stored in memory, which will result in unexpected behaviour if multiple workers are used. To solve this a redis store can be used by installing the redis extra (pip install quart-rate-limiter[redis]) and then using as so,

from quart_rate_limiter.redis_store import RedisStore

redis_store = RedisStore(address)
RateLimiter(app, store=redis_store)

This store uses aioredis, and any extra keyword arguments passed to the RedisStore constructor will be passed to the aioredis create_redis function.

A custom store is possible, see the RateLimiterStoreABC for the required interface.

@app.route('/')
@rate_limit(1, timedelta(seconds=1))
@rate_limit(20, timedelta(minutes=1))
async def handler():
    ...

async def key_function():
    # Return the X-Forwarded-For as the user-agent identifier,
    # unless it isn't present (direct connection).
    return request.headers.get("X-Forwarded-For", request.remote_addr)

RateLimiter(app, key_function=key_function)

Contributing

Quart-Rate-Limiter is developed on GitLab. You are very welcome to open issues or propose merge requests.

$ pip install tox
$ tox

Help

This README is the best place to start, after that try opening an issue.