# Rate Limiting HTTP Requests and Incoming Connections

**URL:** <https://forum.search-guard.com/t/rate-limiting-http-requests-and-incoming-connections/1639>\
**Category:** Feature Requests\
**Created:** [September 3, 2019, 12:43am UTC](https://forum.search-guard.com/t/rate-limiting-http-requests-and-incoming-connections/1639 "2019-09-03T00:43:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jala](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@jala](https://forum.search-guard.com/u/jala)\
**Post date:** [September 3, 2019, 12:43am UTC](https://forum.search-guard.com/t/rate-limiting-http-requests-and-incoming-connections/1639/1 "2019-09-03T00:43:59Z")

</div>

I would like to implement a new feature that would Rate limit the incoming HTTP requests and the connections, if possible for a specific user. Can you please provide me a pointer as where I can add this code.

Regards  
Jalaja

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [September 4, 2019, 9:08am UTC](https://forum.search-guard.com/t/rate-limiting-http-requests-and-incoming-connections/1639/2 "2019-09-04T09:08:39Z")

</div>

Assigned @jkressin on September 4, 2019, 9:08am UTC



---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [September 4, 2019, 9:15am UTC](https://forum.search-guard.com/t/rate-limiting-http-requests-and-incoming-connections/1639/3 "2019-09-04T09:15:02Z")

</div>

Sure, and thanks for working on this. There is already some groundwork to base your code on.

We already have a rate limiting feature regarding failed login attempts. This is to prevent brute force attacks:

> **[Preventing brute force attacks](https://docs.search-guard.com/latest/elasticsearch-brute-force-attacks#limit-login-attempts-by-username-and-authentication-backend)**
>
> By using the Search Guard login limit feature you can secure your Elasticsearch cluster against brute force attacks.

The code for this feature can be extended IMHO to generally limit the request a user can make in a specific timeframe.

A good starting point would be the `com.floragunn.searchguard.auth` package.

Have a look at this abstract base class for example:

`com.floragunn.searchguard.auth.limiting.AbstractRateLimiter`

At the moment limiting and blocking is only implemented when there is an authentication failure. However, the code can be extended by an `onAuthSuccess` method for example, which could then be used to implement a general rate limit by user.

---

<div class="post-metadata">

**Author:** ![jala](https://avatars.discourse-cdn.com/v4/letter/j/cdc98d/32.png) [@jala](https://forum.search-guard.com/u/jala)\
**Post date:** [September 9, 2019, 7:15pm UTC](https://forum.search-guard.com/t/rate-limiting-http-requests-and-incoming-connections/1639/4 "2019-09-09T19:15:10Z")

</div>

Thank you @jkressin. Just started with it, will get back if there are any questions.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [September 30, 2019, 7:15pm UTC](https://forum.search-guard.com/t/rate-limiting-http-requests-and-incoming-connections/1639/5 "2019-09-30T19:15:11Z")

</div>

Closed on September 30, 2019, 7:15pm UTC

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.