Rate Limiting in C++: Libraries and Implementation for API Protection

Rate Limiting in C++: Tools Overview and Implementation

Rate limiting is a critical mechanism for protecting web services, APIs, and microservices from overloads, DDoS attacks, and inefficient resource usage. In the C++ ecosystem, there are several mature libraries and approaches for implementing rate limiting. In this article, we will review the main algorithms, popular libraries, and write code examples.

Popular Rate Limiting Algorithms

Before choosing a library, it is helpful to understand the underlying algorithms:

• Token Bucket — tokens are added at a fixed rate, each request consumes one token. If no tokens are available, the request is rejected. Simple and efficient.
• Sliding Window — tracks the number of requests over the last time interval (e.g., 10 requests per 1 second).
• Fixed Window — a simple counter of requests over a fixed period (e.g., the counter resets every minute).
• Leaky Bucket — requests are queued and processed at a constant rate, excess requests are discarded.

Libraries for Rate Limiting in C++

1. Boost.Token Bucket (Boost.Timer + Manual Implementation)

Boost does not have a ready-made token bucket implementation, but it is easy to write one using boost::timer or std::chrono. However, for production solutions, it is better to use full-fledged libraries.

2. libcppa (C++ Actor Framework)

The libcppa library (now part of CAF — C++ Actor Framework) provides built-in rate limiting mechanisms for actors. It allows limiting the number of messages per unit of time.

#include <caf/all.hpp>

using namespace caf;

behavior rate_limited_actor(event_based_actor* self, int max_requests, duration period) {    auto limiter = self->make_rate_limiter(max_requests, period);    return {        [=](const std::string& msg) {            if (limiter->try_acquire()) {                aout(self) << "Processed: " << msg << endl;            } else {                aout(self) << "Rate limit exceeded for: " << msg << endl;            }        }    };}

3. userver (by Yandex)

The userver framework by Yandex is a powerful solution for high-load services in C++. It includes built-in support for rate limiting via components::RateLimiter and utils::TokenBucket.

#include <userver/utils/token_bucket.hpp>

using namespace userver;

int main() {    utils::TokenBucket limiter(10, std::chrono::seconds(1)); // 10 requests per second    for (int i = 0; i < 20; ++i) {        if (limiter.TryObtain()) {            std::cout << "Request " << i << " allowed";        } else {            std::cout << "Request " << i << " blocked";        }        std::this_thread::sleep_for(std::chrono::milliseconds(50));    }    return 0;}

4. Pistache (HTTP Framework with Rate Limiting)

The Pistache library for creating HTTP servers has built-in middleware for rate limiting. Example:

#include <pistache/endpoint.h>#include <pistache/router.h>#include <pistache/http.h>

using namespace Pistache;

int main() {    Http::Endpoint server(Address(Ipv4::any(), Port(9080)));    auto router = std::make_shared<Rest::Router>();        // Built-in rate limiter: 5 requests per second    router->addMiddleware(Http::Middleware::RateLimit(5, std::chrono::seconds(1)));        Rest::Routes::Get(*router, "/api/resource", [](const Rest::Request& req, Http::ResponseWri