Rate Limiter

Overview

TsgcWSRateLimiter implements a full-featured rate limiting component that protects server endpoints from excessive traffic, abuse and scraping.

At a glance

Features

• Native Delphi implementation with full ANSI/Unicode support.

Technical specification

Main properties

The principal published / public properties used to configure and drive the component. Consult the online help for the full list.

Main methods

The principal public methods exposed by the component.

Public events

The component exposes the following published events; consult the online help for full event-handler signatures.

Quick Start

Drop the component on a form, configure the properties below and activate it. The snippet that follows shows the typical IsConnectionAllowed configuration sourced from the online help.

Delphi (VCL / FireMonkey)

// Manual gate in a custom OnConnect handler
procedure TForm1.ServerConnect(Connection: TsgcWSConnection);
begin
  if not sgcWSRateLimiter1.IsConnectionAllowed(Connection.PeerIP) then
    Connection.Disconnect;
end;

Common scenarios

The following scenarios are lifted verbatim from the online help. Each shows the configuration and method calls needed to drive the component through a specific real-world flow.

1 · RegisterConnection

Registers a new connection for tracking (called automatically by the server).

procedure TForm1.ServerConnect(Connection: TsgcWSConnection);
begin
  sgcWSRateLimiter1.RegisterConnection(Connection.PeerIP);
end;

2 · UnregisterConnection

Removes a connection from tracking (called automatically on disconnect).

procedure TForm1.ServerDisconnect(Connection: TsgcWSConnection);
begin
  sgcWSRateLimiter1.UnregisterConnection(Connection.PeerIP);
end;

3 · BurstProtection

Short-timescale spike detector that puts abusive keys into a cooldown.

// More than 50 requests in 500ms triggers a 30-second cooldown
sgcWSRateLimiter1.BurstProtection.Enabled := True;
sgcWSRateLimiter1.BurstProtection.BurstThreshold := 50;
sgcWSRateLimiter1.BurstProtection.BurstWindowMs := 500;
sgcWSRateLimiter1.BurstProtection.CooldownSec := 30;

4 · Consume

Consumes cost tokens and returns a detailed TsgcRateLimitResult.

var
  oResult: TsgcRateLimitResult;
begin
  oResult := sgcWSRateLimiter1.Consume('apikey:' + ApiKey);
  if not oResult.Allowed then
  begin
    Response.StatusCode := 429;
    Response.CustomHeaders.Values['Retry-After'] := IntToStr(oResult.RetryAfterSec);
    Response.ContentText := 'Throttled: ' + oResult.Reason;
    Exit;
  end;
end;

5 · Enabled

Master switch that turns the entire rate limiter on or off.

// Temporarily disable rate limiting during a load test
sgcWSRateLimiter1.Enabled := False;
try
  RunLoadTest;
finally
  sgcWSRateLimiter1.Enabled := True;
end;

6 · FixedWindow

Fixed Window algorithm configuration: MaxRequests inside a clock-aligned WindowSec.

// Billing-style: 1000 requests per hour, resets on the hour
sgcWSRateLimiter1.FixedWindow.Enabled := True;
sgcWSRateLimiter1.FixedWindow.WindowSec := 3600;
sgcWSRateLimiter1.FixedWindow.MaxRequests := 1000;

Sources used to build this document

Every external claim links back to a primary source. The online-help references decode the canonical deep-link the company maintains for this component.