如何对公共 API 进行速率限制？
我有一个接收输入并提供输出的算法，我希望开发人员像 API 一样使用它。为了防止拒绝服务攻击和过度使用，我需要一些速率限制或保护。我有什么选择？我是否提供帐户和 API 密钥？一般情况下，这会如何运作？对于这种情况还有哪些其他可能的想法？
I have an algorithm that receives input and delivers output which I would like developers to use like an API. To prevent denial of service attack and excessive overuse, I want some rate limits or protection. What options do I have? Do I provide accounts and API keys? How would that generally work? And what other ideas are possible for this scenario?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
帐户和 API 密钥听起来确实是个好主意，如果没有别的办法，它会阻止除您的预期开发人员之外的其他人访问您的 API。
使用一个简单的数据库表记录上次访问特定 API 的时间应该相当简单，并且如果在特定时间范围内访问次数过多，则拒绝重复使用。如果可能，请在下次 API 可在输出中重用时返回，以便开发人员可以相应地进行限制，而不必采用反复试验的方法。
您是否期望一遍又一遍地使用相同的输入，或者它是完全随机的？缓存输出并仅将缓存提供给开发人员直到 API 准备好重用怎么样？这种方法对帐户和密钥的依赖也少得多。
Accounts and API keys does sound like a good idea, if nothing else it stops people other than your intended developers being able to access your API.
It should be fairly straightforward to have a simple database table logging the last time a particular API was accessed, and denying re-use if it is accessed too many times in a certain time frame. If possible, return the next time the API will be available for re-use in the output, so developers can throttle accordingly, instead of having to go for a trial and error approach.
Are you expecting the same inputs to be used over and over again or will it be completely random? What about caching the output and only serving the cache to the developer(s) until the API is ready for re-use? This approach is far less dependent on accounts and keys too.
API 密钥绝对是一个好方法，如果您愿意，还有 openAuth (http://oauth.net)最终用户将通过第三方构建的应用程序访问服务的场景。
如果您不想自己编写速率限制/密钥管理代码，则值得查看 http://www .3scale.net/ 它提供了很多开箱即用的免费服务（以及其他内容，包括开发人员门户、计费等）。作为免责声明，我在那里工作，所以我可能会有一些偏见，但我们试图让这尽可能简单！
我应该补充一点，有一个 3scale 的 PHP 插件，您可以将其放入代码中，然后启用所有的速率限制等。
API keys can definitely be a good way to go, there is also openAuth (http://oauth.net) if you scenarios where end users will be accessing the service via apps built by third parties.
If you don't want to code the rate limits / key management yourself, it's worth taking a look at http://www.3scale.net/ which does a lot of this free out of the box as a service (plus other stuff including a developer portal, billing and so on). As a disclaimer, I work there so I might have some bias but we try to make exactly this as simple as possible!
I should add, there's a PHP plugin for 3scale which you can drop into your code and that'll enable all the rate limits etc.
其他稍微简单但牺牲准确性的选项是使用 IP 地址。显然这更容易克服，但对于不知道 IP 地址是什么的普通用户来说它是有效的。也很容易设置。
这一切都取决于应用程序的复杂性以及您需要花费的时间
other options that are slightly less complex at the expense of accuracy is using the ip address. obviously this is easier to overcome, but for the average user that does not know what an ip address is it works. Also easy to set up.
it all depends on the complexity of the app and the amount of time you got to do it in