DEV Community

Kelwin Dsouza
Kelwin Dsouza

Posted on

API Rate Limiting with Kong: How to Secure & Optimize High-Traffic APIs

🔹 Introduction

APIs power modern applications, but without proper control, they can be exploited by malicious actors or overwhelmed by high traffic. Kong API Gateway provides powerful rate-limiting capabilities to:

✅ Prevent API abuse & DDoS attacks
✅ Ensure fair API usage among consumers
✅ Reduce cloud costs by controlling excessive API requests
✅ Optimize API performance & protect backend resources

In this post, we'll explore how to implement API Rate Limiting using Kong API Gateway with both Kong Gateway (Open-Source) and Kong Enterprise.

1️⃣ Why is API Rate Limiting Important?

APIs must handle varied traffic loads, but without restrictions, they can become unreliable. Here’s why Rate Limiting is crucial:

📌 1. Protect APIs from DDoS Attacks & Abuse
🔹 Hackers can send millions of API requests per second, causing server overload and downtime.
🔹 Kong’s Rate Limiting Plugin helps block excessive traffic & prevent API abuse.

📌 2. Ensure Fair Usage
🔹 Multiple API consumers compete for resources.
🔹 Rate Limiting ensures one user doesn’t monopolize API capacity.

📌 3. Optimize API Performance
🔹 Traffic spikes slow down API responses.
🔹 Rate Limiting ensures consistent API availability.

📌 4. Reduce Cloud & Infrastructure Costs
🔹 APIs running on AWS, GCP, or Azure cost money per request.
🔹 Controlling excessive API calls saves costs & prevents overuse.

2️⃣ Understanding Kong API Rate Limiting Strategies

📌 1. Rate Limiting by IP Address
🔹 Controls traffic based on the client's IP.
🔹 Best for public APIs & protecting from bot attacks.

📌 2. Rate Limiting by API Key / Consumer
🔹 Limits API requests based on unique API keys or authentication tokens.
🔹 Ideal for subscription-based APIs.

📌 3. Rate Limiting by Service or Route
🔹 Restricts traffic to specific API endpoints.
🔹 Useful when some API routes are more resource-intensive.

📌 4. Rate Limiting by Request Headers
🔹 Limits API calls based on custom headers (e.g., User-Agent, Geo-Location).
🔹 Best for dynamic Rate Limiting based on client type.

3️⃣ Setting Up Rate Limiting in Kong API Gateway

📌 Step 1: Install Kong API Gateway (If Not Already Installed)
If you haven’t set up Kong yet, you can install it using Docker:

docker pull kong
docker network create kong-net
docker run -d --name kong-database --network=kong-net \
   -p 5432:5432 \
   -e POSTGRES_USER=kong \
   -e POSTGRES_DB=kong \
   -e POSTGRES_PASSWORD=kong \
   postgres:13
docker run -d --name kong \
   --network=kong-net \
   -e KONG_DATABASE=postgres \
   -e KONG_PG_HOST=kong-database \
   -e KONG_PROXY_ACCESS_LOG=/dev/stdout \
   -e KONG_ADMIN_ACCESS_LOG=/dev/stdout \
   -e KONG_PROXY_ERROR_LOG=/dev/stderr \
   -e KONG_ADMIN_ERROR_LOG=/dev/stderr \
   -e KONG_ADMIN_LISTEN=0.0.0.0:8001 \
   kong
Enter fullscreen mode Exit fullscreen mode

📌 Step 2: Enable the Rate Limiting Plugin
Once Kong is running, enable the Rate Limiting Plugin using the Kong Admin API.

curl -X POST http://localhost:8001/services/{service-name}/plugins \
  --data "name=rate-limiting" \
  --data "config.minute=100" \
  --data "config.policy=local"
Enter fullscreen mode Exit fullscreen mode

🔹 Breakdown:

config.minute=100 → Allows 100 requests per minute.
config.policy=local → Rate limit is enforced per Kong instance.

📌 Step 3: Apply Rate Limiting by Consumer (API Key-based Limiting)
If you want to apply rate limiting per API consumer, use:

curl -X POST http://localhost:8001/consumers/{consumer-id}/plugins \
  --data "name=rate-limiting" \
  --data "config.minute=50" \
  --data "config.policy=redis" \
  --data "config.redis_host=redis"
Enter fullscreen mode Exit fullscreen mode

🔹 Breakdown:

config.minute=50 → Allows 50 requests per minute per API Key.
config.policy=redis → Uses Redis for distributed rate limiting.

📌 Step 4: Apply Rate Limiting by Route (Endpoint-Based Limiting)
If you want to limit traffic to a specific API route, use:

curl -X POST http://localhost:8001/routes/{route-id}/plugins \
  --data "name=rate-limiting" \
  --data "config.hour=500" \
  --data "config.policy=cluster"
Enter fullscreen mode Exit fullscreen mode

🔹 Breakdown:

config.hour=500 → Allows 500 requests per hour per route.
config.policy=cluster → Rate limit is enforced across Kong nodes.

4️⃣ Monitoring Rate Limits in Kong

To check active Rate Limits, use:

curl -X GET http://localhost:8001/plugins?name=rate-limiting
Enter fullscreen mode Exit fullscreen mode

To view logs & analytics, integrate Prometheus & Grafana:

docker run -d --name kong-grafana --network=kong-net -p 3000:3000 grafana/grafana
Enter fullscreen mode Exit fullscreen mode

5️⃣ Handling Rate Limit Exceeded Responses

When an API user exceeds their rate limit, Kong returns:

{
  "message": "API rate limit exceeded. Try again later."
}
Enter fullscreen mode Exit fullscreen mode

To customize this response, modify Nginx templates in Kong.

6️⃣ Key Takeaways

✔ Kong API Gateway provides robust Rate Limiting capabilities.
✔ Different Rate Limiting strategies (IP, API Key, Route-based) can be applied.
✔ Using Redis or Cluster mode enables distributed Rate Limiting.
✔ Monitoring via Kong Admin API & Grafana helps track API usage.

Top comments (0)