Uso de rate limit para garantir a estabilidade e disponibilidade de APIS
Loading...
Date
2024-12
Authors
relationships.isAdvisorOf
Wolf, Alexandre Stürmer
relationships.isRefereeOf
Dertzbacher, Juliano
Diemer, Mouriac Halen
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Em um cenário onde a disponibilidade e estabilidade de APIs são frequentemente comprometidas devido ao mau uso, abusos ou ataques de negação de serviço (DDoS), o rate limit emerge como uma solução eficaz para mitigar esses riscos. Conforme documentado por Toulas (2021), o uso de APIs tem crescido significativamente nos últimos anos, o que, por sua vez, levou a um aumento desproporcional nos ataques a essas interfaces, com um crescimento de 600% em 2021. Esses ataques não apenas comprometem a segurança das APIs, mas também afetam diretamente sua estabilidade e disponibilidade, ressaltando a necessidade urgente de estratégias de segurança robustas. A governança de APIs, através da aplicação de padrões de design como o rate limit, desempenha um papel crucial na proteção dessas interfaces. Ao limitar o número de solicitações permitidas por unidade de tempo, pode-se prevenir sobrecargas, mitigar o impacto de acessos abusivos e proteger contra ataques direcionados. Além disso, essa técnica garante uma distribuição justa dos recursos entre os usuários, o que é essencial para manter a qualidade do serviço, especialmente em ambientes de alta demanda. O desenvolvimento de uma API e a realização de testes no presente estudo de caso validam a eficácia dessa abordagem. No cenário sem rate limit, de cerca de 50.000 requisições em um curto período de tempo, 82,84% falham devido à sobrecarga do sistema. A latência média das requisições de sucesso é de 13 segundos, e o percentil 90 (p90) alcança 26,76 segundos, evidenciando a instabilidade do sistema sob alta carga. Por outro lado, no cenário com rate limit, os erros observados são exclusivamente causados pelo bloqueio da técnica, indicando que os abusos foram controlados conforme esperado pelas políticas configuradas. Assim, a latência das requisições bem-sucedidas se manteve em milissegundos, destacando a estabilidade proporcionada pela solução. Portanto, a adoção de práticas como o rate limit não só promove a resiliência das APIs contra falhas e incidentes de segurança, mas também contribui para o desenvolvimento de aplicações mais confiáveis e robustas, assegurando que essas APIs possam operar de maneira estável e segura mesmo sob condições adversas.
In a scenario where the availability and stability of APIs are often compromised due to misuse, abuse or denial of service (DDoS) attacks, rate limiting emerges as an effective solution to mitigate these risks. As documented by Toulas (2021), the use of APIs has grown significantly in recent years, which in turn has led to a disproportionate increase in attacks on these interfaces, with a growth of 600% in 2021. These attacks not only compromise the security of APIs, but also directly affect their stability and availability, highlighting the urgent need for robust security strategies. API governance, through the application of design patterns such as rate limit, plays a crucial role in protecting these interfaces. By limiting the number of requests allowed per unit of time, you can prevent overloads, mitigate the impact of abusive access and protect against targeted attacks. In addition, this technique ensures a fair distribution of resources among users, which is essential for maintaining quality of service, especially in high-demand environments. The development of an API and testing carried out in this case study validate the effectiveness of this approach. In the scenario without rate limiting, of around 50,000 requests in a short period of time, 82.84% fail due to system overload. The average latency of successful requests is 13 seconds, and the 90th percentile (p90) is 26.76 seconds, showing the instability of the system under high load. On the other hand, in the scenario with rate limit, the errors observed are exclusively caused by the blocking of the technique, indicating that abuse was controlled as expected by the policies configured. Thus, the latency of successful requests remained in milliseconds, highlighting the stability provided by the solution. Therefore, adopting practices such as rate limiting not only promotes API resilience against failures and security incidents, but also contributes to the development of more reliable and robust applications, ensuring that these APIs can operate in a stable and secure manner even under adverse conditions.
In a scenario where the availability and stability of APIs are often compromised due to misuse, abuse or denial of service (DDoS) attacks, rate limiting emerges as an effective solution to mitigate these risks. As documented by Toulas (2021), the use of APIs has grown significantly in recent years, which in turn has led to a disproportionate increase in attacks on these interfaces, with a growth of 600% in 2021. These attacks not only compromise the security of APIs, but also directly affect their stability and availability, highlighting the urgent need for robust security strategies. API governance, through the application of design patterns such as rate limit, plays a crucial role in protecting these interfaces. By limiting the number of requests allowed per unit of time, you can prevent overloads, mitigate the impact of abusive access and protect against targeted attacks. In addition, this technique ensures a fair distribution of resources among users, which is essential for maintaining quality of service, especially in high-demand environments. The development of an API and testing carried out in this case study validate the effectiveness of this approach. In the scenario without rate limiting, of around 50,000 requests in a short period of time, 82.84% fail due to system overload. The average latency of successful requests is 13 seconds, and the 90th percentile (p90) is 26.76 seconds, showing the instability of the system under high load. On the other hand, in the scenario with rate limit, the errors observed are exclusively caused by the blocking of the technique, indicating that abuse was controlled as expected by the policies configured. Thus, the latency of successful requests remained in milliseconds, highlighting the stability provided by the solution. Therefore, adopting practices such as rate limiting not only promotes API resilience against failures and security incidents, but also contributes to the development of more reliable and robust applications, ensuring that these APIs can operate in a stable and secure manner even under adverse conditions.
Description
Keywords
Web Services; API; Rate Limit; Disponibilidade; Teste de carga; Availability; Load Testing
Citation
SIEBENEICHLER, Rafael Luiz. Uso de rate limit para garantir a estabilidade e disponibilidade de APIS. 2024. Monografia (Graduação em Engenharia de Software) – Universidade do Vale do Taquari - Univates, Lajeado, 12 dez. 2024. Disponível em: http://hdl.handle.net/10737/4723.