FastAPI Rate Limiter & Request Tracing Middleware

A FastAPI backend service demonstrating custom HTTP middleware for request tracing, client-based rate limiting, and CORS configuration.

The project provides a /ping endpoint while implementing reusable middleware that manages request IDs and protects the API from excessive requests.

Features

• Custom FastAPI middleware
• Request ID generation and propagation
• Client identification using X-Client-Id
• Sliding-window rate limiting
• HTTP 429 response when the rate limit is exceeded
• CORS configuration
• Configurable allowed origins
• UUID-based request tracing
• Environment-variable based configuration

Tech Stack

• Python
• FastAPI
• Uvicorn
• Starlette Middleware
• UUID
• Collections deque

Architecture

Client
   |
   | HTTP Request
   ↓
Request Context Middleware
   |
   | Generate / preserve X-Request-ID
   ↓
Rate Limiting Middleware
   |
   | Check X-Client-Id
   | Remove expired timestamps
   | Enforce request limit
   ↓
CORS Middleware
   |
   ↓
/ping Endpoint
   |
   ↓
JSON Response

Rate Limiting

The API uses an in-memory sliding-window rate limiter.

Current configuration:

Maximum requests: 11
Time window: 10 seconds

Each client is identified using the X-Client-Id request header.

Example:

X-Client-Id: client-123

For every request, the service:

1. Retrieves the client's request history.
2. Removes timestamps older than the configured window.
3. Checks the number of remaining requests.
4. Rejects the request with HTTP 429 if the limit has been reached.
5. Otherwise records the current timestamp and processes the request.

Request Tracing

Clients can provide their own request ID:

X-Request-ID: abc-123

If the header is not provided, the server generates a UUID automatically.

The request ID is returned in the response:

X-Request-ID: abc-123

This makes it possible to correlate requests across logs and services.

API Endpoint

GET /ping

Returns the configured email and request ID.

Example response:

{
  "email": "example@example.com",
  "request_id": "550e8400-e29b-41d4-a716-446655440000"
}

Rate Limit Response

When a client exceeds the configured rate limit:

HTTP/1.1 429 Too Many Requests

Response:

{
  "detail": "Rate limit exceeded"
}

CORS

The API allows requests only from configured origins.

Allowed origins can be configured in the application:

ALLOWED_ORIGINS = [
    "https://example.com"
]

The API supports:

• GET
• OPTIONS

and explicitly allows the headers required by the application.

Configuration

The service supports environment-based configuration.

Example:

EMAIL=example@example.com

Using environment variables avoids hard-coding configuration values into the application.

Installation

Clone the repository:

git clone <your-repository-url>
cd fastapi-rate-limiter

Create a virtual environment:

python -m venv venv

Activate it on Windows:

venv\Scripts\activate

Install dependencies:

pip install fastapi uvicorn

Run

Start the application:

uvicorn main:app --reload

The API will be available at:

http://127.0.0.1:8000

Test the endpoint:

http://127.0.0.1:8000/ping

Testing Rate Limiting

Send repeated requests with the same client ID:

X-Client-Id: client-123

The first 11 requests within the 10-second window are allowed.

Once the limit is exceeded, the API returns:

429 Too Many Requests

After requests expire from the sliding window, new requests are allowed again.

Project Structure

fastapi-rate-limiter/
│
├── main.py
├── requirements.txt
├── .gitignore
└── README.md

Production Considerations

The current implementation stores rate-limit information in application memory.

For a distributed production deployment with multiple API instances, a shared store such as Redis would be more appropriate.

Possible production improvements include:

• Redis-based distributed rate limiting
• Authentication and authorization
• Structured logging
• Request metrics
• Prometheus monitoring
• Docker deployment
• Automated tests
• Configurable rate limits
• IP-based fallback identification
• Retry-After response headers

Author

Basabdutta Konar