✍️ 필사 모드: API Rate Limiting 완전 가이드 2025: Token Bucket, Sliding Window, 분산 환경, Stripe/GitHub 사례

[악의적 사용자]
   ↓ 초당 10,000 요청
[당신의 API]
   ↓
[DB 다운]
   ↓
[모든 사용자 영향]

def is_allowed(user_id):
    window = current_minute()
    key = f"{user_id}:{window}"
    count = redis.incr(key)
    if count == 1:
        redis.expire(key, 60)
    return count <= LIMIT

def is_allowed(user_id):
    now = time.time()
    key = f"requests:{user_id}"
    
    # 윈도우 밖 요청 제거
    redis.zremrangebyscore(key, 0, now - 60)
    
    # 현재 카운트
    count = redis.zcard(key)
    
    if count < LIMIT:
        redis.zadd(key, {str(now): now})
        redis.expire(key, 60)
        return True
    return False

def is_allowed(user_id):
    now = time.time()
    current_window = int(now // 60)
    previous_window = current_window - 1
    
    current_count = redis.get(f"{user_id}:{current_window}") or 0
    previous_count = redis.get(f"{user_id}:{previous_window}") or 0
    
    # 이전 윈도우의 비율 계산
    elapsed_in_current = now - (current_window * 60)
    weight = (60 - elapsed_in_current) / 60
    
    estimated = (previous_count * weight) + current_count
    
    if estimated < LIMIT:
        redis.incr(f"{user_id}:{current_window}")
        return True
    return False

def is_allowed(user_id):
    key = f"bucket:{user_id}"
    bucket = redis.hgetall(key)
    
    now = time.time()
    last_refill = float(bucket.get('last_refill', now))
    tokens = float(bucket.get('tokens', BUCKET_SIZE))
    
    # 토큰 충전
    elapsed = now - last_refill
    tokens = min(BUCKET_SIZE, tokens + elapsed * REFILL_RATE)
    
    if tokens >= 1:
        tokens -= 1
        redis.hset(key, mapping={
            'tokens': tokens,
            'last_refill': now
        })
        return True
    return False

[요청] → [큐] → [일정 속도로 처리]
              큐 가득 차면 거부

[Server 1] [Server 2] [Server 3]
    ↓         ↓         ↓
   각 서버가 자기 카운터?
   → 사용자가 3대에 분산되면 3배 통과!

LUA_SCRIPT = """
local key = KEYS[1]
local capacity = tonumber(ARGV[1])
local refill_rate = tonumber(ARGV[2])
local now = tonumber(ARGV[3])
local cost = tonumber(ARGV[4])

local bucket = redis.call('HMGET', key, 'tokens', 'last_refill')
local tokens = tonumber(bucket[1]) or capacity
local last_refill = tonumber(bucket[2]) or now

-- 충전
local elapsed = now - last_refill
tokens = math.min(capacity, tokens + elapsed * refill_rate)

if tokens >= cost then
    tokens = tokens - cost
    redis.call('HMSET', key, 'tokens', tokens, 'last_refill', now)
    redis.call('EXPIRE', key, 3600)
    return 1
else
    return 0
end
"""

def is_allowed(user_id):
    return redis.eval(
        LUA_SCRIPT,
        1,
        f"bucket:{user_id}",
        100,    # capacity
        10,     # refill rate
        time.time(),
        1       # cost
    )

def is_allowed(user_id):
    now = time.time()
    window_start = now - 60
    
    pipe = redis.pipeline()
    pipe.zremrangebyscore(f"requests:{user_id}", 0, window_start)
    pipe.zadd(f"requests:{user_id}", {str(now): now})
    pipe.zcard(f"requests:{user_id}")
    pipe.expire(f"requests:{user_id}", 60)
    _, _, count, _ = pipe.execute()
    
    return count <= LIMIT

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 60
RateLimit-Limit: 100
RateLimit-Remaining: 0
RateLimit-Reset: 1681545660

{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Try again in 60 seconds.",
  "retry_after": 60
}

RateLimit-Limit: 100         # 윈도우 한도
RateLimit-Remaining: 42      # 남은 요청
RateLimit-Reset: 1681545660  # Reset 시간 (Unix)

Retry-After: 60                          # 초
Retry-After: Wed, 21 Oct 2025 07:28:00 GMT  # 절대 시간

import requests
from time import sleep

def call_api(url):
    while True:
        response = requests.get(url)
        
        if response.status_code == 429:
            retry_after = int(response.headers.get('Retry-After', 60))
            print(f"Rate limited. Waiting {retry_after}s...")
            sleep(retry_after)
            continue
        
        return response

# 예방적 - 남은 요청 확인
def call_api_smart(url):
    response = requests.get(url)
    
    remaining = int(response.headers.get('RateLimit-Remaining', 100))
    if remaining < 10:
        print("Slowing down...")
        sleep(1)
    
    return response

def get_client_ip(request):
    # CDN 뒤에 있을 때
    forwarded = request.headers.get('X-Forwarded-For')
    if forwarded:
        # 첫 IP가 실제 클라이언트
        return forwarded.split(',')[0].strip()
    return request.remote_addr

def check_all_limits(user_id, ip, endpoint):
    return (
        check_global_limit() and
        check_user_limit(user_id) and
        check_ip_limit(ip) and
        check_endpoint_limit(user_id, endpoint)
    )

Free tier:    100 RPM, 10K req/day
Pro tier:     1000 RPM, 100K req/day
Enterprise:   10000 RPM, unlimited

TIER_LIMITS = {
    'free': {'rpm': 100, 'daily': 10000},
    'pro': {'rpm': 1000, 'daily': 100000},
    'enterprise': {'rpm': 10000, 'daily': float('inf')}
}

def get_limit(user):
    return TIER_LIMITS[user.tier]

def get_limit():
    hour = datetime.now().hour
    if 9 <= hour <= 18:  # 비즈니스 시간
        return STRICT_LIMIT
    return RELAXED_LIMIT

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
{
  "error": {
    "type": "rate_limit_error",
    "message": "Too many requests hit the API too quickly. ..."
  }
}

POST /v1/charges
Idempotency-Key: my-unique-key-123

import time
import random

def stripe_request(method, url, **kwargs):
    max_retries = 3
    base_delay = 1
    
    for attempt in range(max_retries):
        response = requests.request(method, url, **kwargs)
        
        if response.status_code != 429:
            return response
        
        # Exponential backoff with jitter
        delay = base_delay * (2 ** attempt) + random.uniform(0, 1)
        time.sleep(delay)
    
    raise Exception("Max retries exceeded")

query {
  repository(owner: "facebook", name: "react") {
    issues(first: 100) {
      nodes {
        title
        comments(first: 100) {
          nodes {
            author { login }
          }
        }
      }
    }
  }
}

X-RateLimit-Limit: 5000
X-RateLimit-Remaining: 4995
X-RateLimit-Reset: 1681545660
X-RateLimit-Used: 5
X-RateLimit-Resource: core

[CloudFlare DDoS 보호]
       ↓
[L7 WAF (rate limiting)]
       ↓
[Application rate limit]
       ↓
[DB connection limit]

- Total requests
- Rate limited requests (429s)
- Per-user rate limit hits
- Per-endpoint rate limit hits
- Top rate limited users
- Rate limit hit rate (%)

사용 80% → 알림
사용 100% → 차단
지속 abuse → 계정 일시 정지

RateLimit-Remaining: 50

WHITELIST = {'192.168.1.0/24', 'partner-api-key-xyz'}

def is_whitelisted(user_id, ip):
    return user_id in WHITELIST or ip in WHITELIST_IPS