Rate Limiting with Spring Cloud Netflix Zuul: Filters and Configuration

import com.netflix.zuul.ZuulFilter;
import com.netflix.zuul.context.RequestContext;
import com.netflix.zuul.exception.ZuulException;
import org.springframework.cloud.netflix.zuul.filters.support.FilterConstants;
import org.springframework.stereotype.Component;

@Component
public class RateLimitFilter extends ZuulFilter {

    @Override
    public String filterType() {
        return "pre";
    }

    @Override
    public int filterOrder() {
        return 1; // High priority
    }

    @Override
    public boolean shouldFilter() {
        // You can skip rate limiting for certain routes
        RequestContext ctx = RequestContext.getCurrentContext();
        String requestURI = ctx.getRequest().getRequestURI();
        return !requestURI.startsWith("/health");
    }

    @Override
    public Object run() throws ZuulException {
        // Rate limiting logic goes here
        return null;
    }
}

import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.core.script.DefaultRedisScript;
import org.springframework.stereotype.Component;

import java.util.Arrays;
import java.util.List;

@Component
public class TokenBucketRateLimiter {

    private final RedisTemplate<String, String> redisTemplate;
    private final DefaultRedisScript<Long> rateLimitScript;

    public TokenBucketRateLimiter(RedisTemplate<String, String> redisTemplate) {
        this.redisTemplate = redisTemplate;
        String script = """
            local key = KEYS[1]
            local capacity = tonumber(ARGV[1])
            local refillRate = tonumber(ARGV[2])
            local now = tonumber(ARGV[3])
            local requested = tonumber(ARGV[4])
            
            local bucket = redis.call('hmget', key, 'tokens', 'last_refill')
            local tokens = tonumber(bucket[1])
            local lastRefill = tonumber(bucket[2])
            
            if tokens == nil then
                tokens = capacity
                lastRefill = now
            end
            
            local elapsed = math.max(0, now - lastRefill)
            local refill = elapsed * refillRate
            tokens = math.min(capacity, tokens + refill)
            
            if tokens >= requested then
                tokens = tokens - requested
                redis.call('hmset', key, 'tokens', tokens, 'last_refill', now)
                return 1
            else
                return 0
            end
        """;
        this.rateLimitScript = new DefaultRedisScript<>(script, Long.class);
    }

    public boolean tryConsume(String key, int capacity, double refillRate, int requested) {
        List<String> keys = Arrays.asList(key);
        long now = System.currentTimeMillis() / 1000;
        Long result = redisTemplate.execute(rateLimitScript, keys,
                String.valueOf(capacity),
                String.valueOf(refillRate),
                String.valueOf(now),
                String.valueOf(requested));
        return result != null && result == 1L;
    }
}

import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.cloud.context.config.annotation.RefreshScope;
import org.springframework.stereotype.Component;

import java.util.HashMap;
import java.util.Map;

@Component
@RefreshScope
@ConfigurationProperties(prefix = "rate-limiter")
public class RateLimitProperties {

    private CapacityRefill defaults = new CapacityRefill();
    private Map<String, CapacityRefill> routes = new HashMap<>();
    private Map<String, CapacityRefill> clients = new HashMap<>();

    // getters and setters

    public static class CapacityRefill {
        private int capacity;
        private double refillRate;
        // getters and setters
    }
}

@Override
public Object run() throws ZuulException {
    RequestContext ctx = RequestContext.getCurrentContext();
    HttpServletRequest request = ctx.getRequest();
    
    String clientId = request.getHeader("X-Client-Id");
    String route = getRoute(request.getRequestURI());
    String key = buildKey(clientId, route);
    
    RateLimitProperties.CapacityRefill config = getConfig(clientId, route);
    
    boolean allowed = rateLimiter.tryConsume(key, config.getCapacity(), config.getRefillRate(), 1);
    
    if (!allowed) {
        ctx.setResponseStatusCode(429);
        ctx.addZuulResponseHeader("Retry-After", "1");
        ctx.addZuulResponseHeader("X-RateLimit-Limit", String.valueOf(config.getCapacity()));
        ctx.addZuulResponseHeader("X-RateLimit-Remaining", "0");
        ctx.setResponseBody("{\"error\":\"Too Many Requests\"}");
        ctx.setSendZuulResponse(false);
    }
    return null;
}

private String buildKey(String clientId, String route) {
    if (clientId == null) {
        RequestContext ctx = RequestContext.getCurrentContext();
        clientId = ctx.getRequest().getRemoteAddr();
    }
    return String.format("ratelimit:%s:%s", clientId, route);
}

private RateLimitProperties.CapacityRefill getConfig(String clientId, String route) {
    // Check client-specific config first
    if (properties.getClients().containsKey(clientId)) {
        return properties.getClients().get(clientId);
    }
    // Then route-specific
    if (properties.getRoutes().containsKey(route)) {
        return properties.getRoutes().get(route);
    }
    // Fallback to defaults
    return properties.getDefaults();
}

private String getRoute(String requestURI) {
    // Extract route from URI, e.g., /payment/order -> payment
    String[] parts = requestURI.split("/");
    return parts.length > 1 ? parts[1] : "default";
}

private void rejectRequest(RequestContext ctx, RateLimitProperties.CapacityRefill config) {
    ctx.setResponseStatusCode(429);
    ctx.addZuulResponseHeader("Content-Type", "application/json");
    ctx.addZuulResponseHeader("Retry-After", "1");
    ctx.addZuulResponseHeader("X-RateLimit-Limit", String.valueOf(config.getCapacity()));
    ctx.addZuulResponseHeader("X-RateLimit-Remaining", "0");
    // Calculate reset time: current time + refill interval
    long resetTime = System.currentTimeMillis() / 1000 + (long) (1 / config.getRefillRate());
    ctx.addZuulResponseHeader("X-RateLimit-Reset", String.valueOf(resetTime));
    
    String errorBody = String.format(
        "{\"error\":\"Too Many Requests\",\"message\":\"Rate limit exceeded. Retry after 1 second.\",\"status\":429}"
    );
    ctx.setResponseBody(errorBody);
    ctx.setSendZuulResponse(false);
}

import io.micrometer.core.instrument.MeterRegistry;
import io.micrometer.core.instrument.Counter;
import io.micrometer.core.instrument.Timer;
import org.springframework.stereotype.Component;

@Component
public class RateLimitMetrics {

    private final Counter allowedCounter;
    private final Counter rejectedCounter;
    private final Timer redisLatency;

    public RateLimitMetrics(MeterRegistry registry) {
        this.allowedCounter = registry.counter("ratelimit.requests.allowed");
        this.rejectedCounter = registry.counter("ratelimit.requests.rejected");
        this.redisLatency = registry.timer("ratelimit.redis.latency");
    }

    public void recordAllowed() {
        allowedCounter.increment();
    }

    public void recordRejected() {
        rejectedCounter.increment();
    }

    public void recordRedisLatency(long duration, TimeUnit unit) {
        redisLatency.record(duration, unit);
    }
}