DEV Community: zlynv

Every Python rate limiter has this DDoS blind spot — I built one that doesn't

zlynv — Sun, 02 Aug 2026 11:45:25 +0000

Every Python rate limiter has this DDoS blind spot — I built one that doesn't

10,000 bots hit your API. Each one sends exactly 1 request per minute. Every single bot is under your rate limit. Your slowapi or flask-limiter sees nothing wrong.

But your server is drowning.

I discovered this the hard way. After deploying slowapi in production for 6 months, I realized it had a fundamental blind spot: it counts requests, but it doesn't detect attacks.

So I built drogue — and tested it under real DDoS traffic.

The blind spot

Every rate limiter I tested works the same way:

# This catches overuse. It doesn't catch distributed attacks.
@app.get("/api/data")
@limiter.limit("100/minute")
async def get_data():
    return {"data": "value"}

The problem: rate limiting and DDoS detection are different problems.

Rate limiting catches single clients exceeding limits. It misses distributed attacks where each client stays under the limit.
DDoS detection catches anomalous traffic patterns. It's a different layer entirely.

Most Python libraries only solve the first one. I needed both.

What I tested

I benchmarked 5 rate limiting approaches under simulated DDoS traffic:

slowapi: Rate limiting only. No DDoS detection. No WebSocket support.
flask-limiter: Rate limiting only. Flask-specific. No DDoS detection.
pyrate-limiter: Rate limiting only. Algorithm-focused. No framework adapters.
ratethrottle: Rate limiting + DDoS detection + WebSocket support. No trust system.
drogue: Rate limiting + DDoS detection + WebSocket support + trust state machine + circuit breaker.

The key difference: drogue has a Z-score anomaly detector that learns what "normal" traffic looks like and flags statistical outliers.

How it works

drogue adds two layers that rate limiters miss:

1. Z-score anomaly detection

This tracks request rates per client and compares each client against the distribution of all client rates. When a client's rate deviates significantly from peers, it gets blocked. A client sending 5x more than the average gets flagged.

2. Progressive bans

After 5 violations, bans escalate automatically:

Level 1: 1 minute
Level 2: 10 minutes
Level 3: 1 hour
Level 4: 24 hours

Most libraries only count requests. drogue detects attacks.

The results

I ran a DDoS simulation with 50 concurrent users (mix of normal users and attackers):

Metric	Result
Total requests	42,815
Requests/sec	2,173.9
Attackers banned (403)	97.8% of attacker traffic
Rate limited (429)	0.02%
Successful attacks	0

97.8% of requests from attackers were banned. The remaining 2.2% were legitimate traffic that passed through. Note: this is the combined result of anomaly detection, progressive bans, and endpoint rate limits working together, not the anomaly detector alone.

Response time overhead: p50=5ms, p95=7ms, p99=10ms. Less than 10ms for most applications.

The feature comparison

Here's what drogue includes that others don't:

Feature	drogue	slowapi	flask-limiter
DDoS detection	Z-score	No	No
Progressive bans	Auto-escalating	No	No
Trust state machine	7 states	No	No
WebSocket protection	Yes	No	No
Circuit breaker	Yes	No	No
5 algorithms	TB/SW/FW/GCRA/LB	1	1
Framework support	FastAPI/Django/Flask/DRF	FastAPI	Flask

What I got wrong

My first attempt was simple: blacklist IPs that hit the endpoint too many times. It didn't work. Attackers rotate IPs every few minutes. By the time I banned one IP, they had already moved to another.

My second attempt: set a threshold of 1,000 requests per minute. If a client exceeds it, ban them. This also failed. The attack was distributed across 50,000 IPs. Each one was sending only 10 requests per minute. Every single bot was under the threshold.

The lesson: we can't catch a distributed attack with threshold-based rules. We need cross-sectional comparison across clients.

Where drogue is today

drogue's Z-score detector compares each client's rate against the distribution of all client rates. A client sending 5x more than peers gets flagged. This catches bursty attackers who stand out from normal traffic.

But it doesn't catch everything. If 50,000 bots each send exactly the same rate, no one is an outlier. And if attackers rotate IPs, bans don't follow them. These are hard problems that need browser fingerprinting and global traffic analysis, neither of which drogue does yet.

The core insight still holds: rate limiting alone isn't enough. But drogue is a step toward better protection, not a complete solution.

The counterintuitive truth

The fastest rate limiter isn't the best one.

drogue is slower than slowapi. 5ms overhead vs 2ms. That's a 2.5x difference. In benchmarks, slowapi wins.

But slowapi doesn't detect DDoS attacks. It doesn't ban attackers. It doesn't learn what "normal" traffic looks like.

Protection isn't about speed. It's about coverage.

Getting started

pip install drogue[fastapi]

from fastapi import FastAPI
from drogue.adapters.fastapi import DrogueLimiter

app = FastAPI()
limiter = DrogueLimiter(app, default_limits=["100/minute"])

@app.get("/api/data")
@limiter.limit("10/minute")
async def get_data():
    return {"data": "value"}

That's it. No request: Request. No configuration files. DDoS protection built in.

What's next

drogue v0.2.0 is out now with:

GCRA + Leaky Bucket algorithms
MongoDB storage backend
Thread safety guarantees
Full benchmark suite

v0.3 will add:

Redis-backed ban persistence
Trust cache sync across workers

Try it out

Have you been hit by a distributed attack that your rate limiter missed? I'd love to hear about it in the comments.

Building a Modern Rate Limiter and DDoS Protection Library for Python

zlynv — Wed, 29 Jul 2026 03:31:10 +0000

Rate limiting is one of those features every production API eventually needs.

Whether you're building a public REST API, a WebSocket service, or an authentication endpoint, you'll eventually face problems like:

Credential stuffing
Brute-force attacks
API abuse
Bots scraping your endpoints
Unexpected traffic spikes

Most applications solve this with a simple request counter.

But after building several APIs with Django, FastAPI, and Flask, I realized that production traffic requires much more than "X requests per minute."

That observation led me to build drogue, an open-source Python library for rate limiting and traffic protection.

The Problem

Traditional rate limiting is straightforward:

Allow 100 requests per minute.

This works well for many cases, but real-world applications quickly expose its limitations.

For example:

A distributed attack can remain below the per-IP limit.
A bot can rotate through proxies.
WebSocket connections often require different handling than HTTP requests.
Different endpoints need different protection strategies.

I wanted a system that could go beyond simple request counting.

Design Goals

From the beginning, I focused on a few principles.

1. Clean framework integration

I didn't want endpoint functions filled with framework-specific plumbing.

Instead, the library should feel like a natural extension of the framework.

from fastapi import FastAPI
from drogue.adapters.fastapi import DrogueLimiter

app = FastAPI()

limiter = DrogueLimiter(app, default_limits=["100/minute"])

@app.get("/users")
@limiter.limit("10/minute")
async def users():
    return {"status": "ok"}

No additional request objects.
No complicated middleware configuration.
Minimal boilerplate.

Multiple Rate Limiting Algorithms

Different applications require different algorithms.

Instead of supporting only one approach, drogue includes multiple options:

Token Bucket
Sliding Window
Fixed Window

Each has different trade-offs between accuracy, burst handling, and memory usage.

Beyond Rate Limiting

One thing I kept noticing was that abusive traffic often doesn't violate the configured limits.

An attacker may intentionally stay below the threshold.

That's why I started experimenting with additional protection mechanisms such as:

Traffic anomaly detection
Progressive temporary bans
Probe detection
Circuit breakers
CIDR filtering
Shadow mode for safely testing rules

Rather than replacing traditional rate limiting, these features complement it.

WebSocket Support

Many existing rate limiting solutions primarily focus on HTTP.

Modern applications increasingly rely on WebSockets for:

Chat applications
Live dashboards
Multiplayer games
Real-time notifications

Supporting both HTTP and WebSocket traffic from the same library became an important design goal.

Framework Support

Currently, drogue provides adapters for:

Django
Django REST Framework
FastAPI
Flask

The goal is to keep the developer experience as consistent as possible across frameworks.

Performance

Performance matters because rate limiting runs on every request.

The core package is designed with minimal overhead while keeping the implementation extensible enough for different storage backends and deployment scenarios.

Performance testing and optimization remain an ongoing part of development, and I plan to continue publishing benchmark improvements as the project evolves.

Lessons Learned

Building this project taught me several things:

Good APIs are often harder to design than efficient algorithms.
Framework integration significantly affects developer experience.
Rate limiting alone isn't enough for many production environments.
Clear documentation is just as important as clean code.
Simplicity usually wins over feature overload.

What's Next

There are still many ideas I'd like to explore, including:

Additional storage backends
More adaptive protection strategies
Better observability
Additional framework integrations
More comprehensive benchmarking

I'd Love Your Feedback

This project is still evolving, and feedback from the Python community is incredibly valuable.

If you build production APIs with Django, FastAPI, Flask, or another Python framework, I'd love to hear your thoughts.

What features do you look for in a rate limiting library?
What challenges have you encountered protecting public APIs?
Is there something missing that would make a library like this more useful?

The project is open source, and contributions, suggestions, and constructive criticism are always welcome.

Building infrastructure libraries is always a balancing act between performance, flexibility, and developer experience. Drogue is my attempt to make API protection easier without sacrificing clean application code.

If you're building production APIs with Django, FastAPI, Flask, or another Python framework, I'd love to hear your thoughts. Whether it's an issue, feature request, benchmark, or pull request, your feedback will help shape the project.

GitHub: https://github.com/zlynv/drogue
Documentation: https://zlynv.github.io/drogue/
PyPI: pip install drogue