Question

I have 2 POST, 1 PUT and 1 DELETE API in my application. My application is deployed on Heroku. I want to rate limit these APIs but only to prevent against a DOS attack or in case someone by mistake calls API in infinite loop. What’s the ideal rate limit for this scenario. E.g. x per minute, y per hour. What are the idea numbers for x and y?

Answer 1

This really depends on your app.

1) It depends on how “heavy” your app is:

If each of your requests are processor-heavy and/or hits your database a lot, then you’ll want to set a low limit, because each request is “expensive”. If your app is fast and efficient, then you have more room to maneuver and you can get set a higher API limit.

2) It depends on the use cases of your app.

Does your app require a lot of API hits to be useable? How does an API limit affect the features your app provides?

3) It depends on how many processors you have.

Heroku allows you to scale your app by setting web dynos and worker dynos. The more you have, the better you’ll be able offer high API limits.

In any case, if you want to prevent someone from DOS-ing you or calling your API in an infinite loop, this is the wrong approach to take because an API limit affects the good guys as well as the bad guys. A better way is to detect the bad behaviour and respond appropriately (i.e. deny the offending IP address for a limited time).