SlideShare a Scribd company logo
1 of 30
Download to read offline
All rights reserved by Postman Inc
Not Your Grandma’s
Rate Limiting
Meenakshi Dhanani
Developer Relations Engineer,
GraphQL
Bonjour de l’Inde
Meenakshi Dhanani (aka Meena) 󰏝
@mdhananii
DEVELOPER RELATIONS ENGINEER, GRAPHQL
Likes:
- Yoga, strength training 󰙥
- Spanish 󰎼
“
@getpostman @mdhananii
Introduction to Rate Limiting APIs
Challenges with Rate Limiting GraphQL APIs
Optimization Techniques for GraphQL APIs
Real world examples
Road Ahead
1
2
3
4
5
Overview
@getpostman @mdhananii
Introduction to
Rate Limiting
THE CONTEXT
@getpostman @mdhananii
Rate Limiting
● Minimize load
Rate limiting enforces a controlled flow of
requests, preventing system congestion and
downtime due to excessive demand.
● Ensure fair usage
Rate limiting ensures fair usage by setting
predefined limits on how often each client or user
can access resources, preventing any single
entity from monopolizing the system's resources.
Safeguards against bursts of incoming traffic
@getpostman @mdhananii
An API rate limit is essentially a
way for Shopify to ensure
stability of the platform
Zameer Masjedee
Office of the President, Technology Lead at Shopify
“
@getpostman @mdhananii
Challenges with
Rate Limiting
GraphQL APIs
THE PROBLEM
@getpostman @mdhananii
@getpostman @mdhananii
Optimizing for
GraphQL
THE SOLUTION
@getpostman @mdhananii
@getpostman @mdhananii
Query Cost Analysis
● Type complexity
Type complexity reflects the size of the data retrieved
by a query.
● Resolve complexity
Resolve complexity reflects the server’s query
execution cost
Shopify Engineering Blog
@getpostman @mdhananii
Benefits of Cost Analysis for Service Providers
● Inform load balancing
Distribute incoming queries across server instances
based on their complexity, ensuring even processing
and preventing overloading of resources.
● Resolver resource allocation
Developers can allocate resources more effectively,
optimize resolver functions, and prioritize high-impact
queries, resulting in better overall performance and
efficient use of server resources.
● Threat prevention
Attackers are discouraged from crafting overly
complex or deeply nested queries that could degrade
server performance or cause denial-of-service
attacks.
● Monetization
Pricing based on the execution cost or response size.
@getpostman @mdhananii
Query Cost vs Execution Time
Query Cost
Analysis
Techniques
THE HOW
@getpostman @mdhananii
@getpostman @mdhananii
Static Cost Analysis
Blocks queries above a certain complexity, before they execute
@getpostman @mdhananii
Dynamic Cost Analysis
Block queries above a certain complexity, during execution
@getpostman @mdhananii
Response Cost Analysis
Calculates complexity after the execution, based on the response.
@getpostman @mdhananii
Key Considerations
● Introspection Queries
Ensuring that introspection queries are subject to rate
limiting or handled separately is crucial for security.
● Pagination
Pagination arguments significantly impact cost
calculation. The same field with different pagination
sizes can have vastly different costs.
● Upper Bound vs Actual Response
When clients request a large number of items, but the
actual response contains fewer items, there's a
potential mismatch between the charged cost and the
delivered value
● Complexity Calculation Overhead
The process of calculating query complexity itself can
introduce overhead, especially for deeply nested
queries.
Examples
REAL WORLD SCHEMAS
@getpostman @mdhananii
@getpostman @mdhananii
Shopify Query Cost Analysis
@getpostman @mdhananii
GitHub Query Cost Analysis
@getpostman @mdhananii
Yelp Query Cost Analysis
@getpostman @mdhananii
No Right Answer
Examples illustrate a good rate limiting strategy
consists of not one but a combination of all these
techniques.
@getpostman @mdhananii
Traditional Architecture for Rate Limiting
● Gateways/Routers
API gateways can centralize the management
of APIs, making it easier to control access,
monitor traffic, and troubleshoot problems.
Road Ahead
@getpostman @mdhananii
SNEAK PEEK INTO THE FUTURE
@getpostman @mdhananii
Implementation Strategies
● Compilers
A compiler transforms GraphQL queries into an
optimized representation. This representation can
then be used to implement rate limiting more
efficiently.
● Machine Learning Approach
Machine learning can be used to learn the patterns of
legitimate and malicious traffic. This information can
then be used to optimize the rate limiting rules to
better protect the API from abuse.
During this session, we learned:
● What is rate limiting APIs?
● Why is rate limiting for GraphQL different from other APIs?
● Query cost analysis - techniques, examples
● Peek into future strategies
Recap
@getpostman @mdhananii
GraphQL Concepts
@getpostman @mdhananii
API Rate Limits and Working with GraphQL
https://www.shopify.com/partners/blog/graphql-rate-limits
A Guide to GraphQL Rate Limiting and Security
https://xuorig.medium.com/a-guide-to-graphql-rate-limiting-security-e62a86ef8114
Why does GraphQL need cost analysis? | Morris Matsa
https://mmatsa.com/blog/why-cost-analysis/
A Principled Approach to GraphQL Query Cost Analysis
https://arxiv.org/pdf/2009.05632.pdf
Additional Resources
@getpostman @mdhananii
Q&A
Please tell us about your
experience!
@getpostman @mdhananii
Thank You
@getpostman @mdhananii

More Related Content

Similar to Not Your Grandma’s Rate Limiting (slides)

SigOpt for Hedge Funds
SigOpt for Hedge FundsSigOpt for Hedge Funds
SigOpt for Hedge FundsSigOpt
 
Webapp Automation Testing of performance marketing and media platform
Webapp Automation Testing of performance marketing and media platformWebapp Automation Testing of performance marketing and media platform
Webapp Automation Testing of performance marketing and media platformKnoldus Inc.
 
GridMAP: Next generation energy analysis tools.
GridMAP: Next generation energy analysis tools.GridMAP: Next generation energy analysis tools.
GridMAP: Next generation energy analysis tools.Iain Beveridge
 
Selling commercial Solar +/or Energy Storage solutions? You need GridMAP!
Selling commercial Solar +/or Energy Storage solutions? You need GridMAP!    Selling commercial Solar +/or Energy Storage solutions? You need GridMAP!
Selling commercial Solar +/or Energy Storage solutions? You need GridMAP! Iain Beveridge
 
Qualitia - Scriptless Test Automation Platform
Qualitia - Scriptless Test Automation PlatformQualitia - Scriptless Test Automation Platform
Qualitia - Scriptless Test Automation PlatformMonica Paul
 
Data mining for_java_and_dot_net 2016-17
Data mining for_java_and_dot_net 2016-17Data mining for_java_and_dot_net 2016-17
Data mining for_java_and_dot_net 2016-17redpel dot com
 
Agile Mumbai 2019 Conference | Intelligent DevOps enabling Enterprise Agilit...
Agile Mumbai 2019 Conference |  Intelligent DevOps enabling Enterprise Agilit...Agile Mumbai 2019 Conference |  Intelligent DevOps enabling Enterprise Agilit...
Agile Mumbai 2019 Conference | Intelligent DevOps enabling Enterprise Agilit...AgileNetwork
 
How can we use LangChain for Data Analysis_ A Detailed Perspective.pdf
How can we use LangChain for Data Analysis_ A Detailed Perspective.pdfHow can we use LangChain for Data Analysis_ A Detailed Perspective.pdf
How can we use LangChain for Data Analysis_ A Detailed Perspective.pdfBluebash LLC
 
Big Data - Hadoop and MapReduce for QA and testing by Aditya Garg
Big Data - Hadoop and MapReduce for QA and testing by Aditya GargBig Data - Hadoop and MapReduce for QA and testing by Aditya Garg
Big Data - Hadoop and MapReduce for QA and testing by Aditya GargQA or the Highway
 
AyyappaKumar_AutomationTesting
AyyappaKumar_AutomationTestingAyyappaKumar_AutomationTesting
AyyappaKumar_AutomationTestingAyyappa Kumar
 
Getting start with Performance Testing
Getting start with Performance Testing Getting start with Performance Testing
Getting start with Performance Testing Yogesh Deshmukh
 
Optimizing API Performance Testing A Comprehensive Guide
Optimizing API Performance Testing A Comprehensive GuideOptimizing API Performance Testing A Comprehensive Guide
Optimizing API Performance Testing A Comprehensive GuideTestrig Technologies
 
[Webinar] Getting started with server-side testing - presented by WiderFunnel...
[Webinar] Getting started with server-side testing - presented by WiderFunnel...[Webinar] Getting started with server-side testing - presented by WiderFunnel...
[Webinar] Getting started with server-side testing - presented by WiderFunnel...Chris Goward
 
2020 10-08 measuring-qualityinproduction
2020 10-08 measuring-qualityinproduction2020 10-08 measuring-qualityinproduction
2020 10-08 measuring-qualityinproductionAbigail Bangser
 
Past Experiences and Future Challenges using Automatic Performance Modelling ...
Past Experiences and Future Challenges using Automatic Performance Modelling ...Past Experiences and Future Challenges using Automatic Performance Modelling ...
Past Experiences and Future Challenges using Automatic Performance Modelling ...Paul Brebner
 
Quality at the speed of digital
Quality   at the speed of digitalQuality   at the speed of digital
Quality at the speed of digitalrajni singh
 
Breaking Up the Monolith While Migrating to AWS (GPSTEC320) - AWS re:Invent 2018
Breaking Up the Monolith While Migrating to AWS (GPSTEC320) - AWS re:Invent 2018Breaking Up the Monolith While Migrating to AWS (GPSTEC320) - AWS re:Invent 2018
Breaking Up the Monolith While Migrating to AWS (GPSTEC320) - AWS re:Invent 2018Amazon Web Services
 
Quality automation at walmart scale
Quality automation at walmart scaleQuality automation at walmart scale
Quality automation at walmart scaleTest Armada
 

Similar to Not Your Grandma’s Rate Limiting (slides) (20)

SigOpt for Hedge Funds
SigOpt for Hedge FundsSigOpt for Hedge Funds
SigOpt for Hedge Funds
 
Webapp Automation Testing of performance marketing and media platform
Webapp Automation Testing of performance marketing and media platformWebapp Automation Testing of performance marketing and media platform
Webapp Automation Testing of performance marketing and media platform
 
GridMAP: Next generation energy analysis tools.
GridMAP: Next generation energy analysis tools.GridMAP: Next generation energy analysis tools.
GridMAP: Next generation energy analysis tools.
 
Selling commercial Solar +/or Energy Storage solutions? You need GridMAP!
Selling commercial Solar +/or Energy Storage solutions? You need GridMAP!    Selling commercial Solar +/or Energy Storage solutions? You need GridMAP!
Selling commercial Solar +/or Energy Storage solutions? You need GridMAP!
 
Qualitia - Scriptless Test Automation Platform
Qualitia - Scriptless Test Automation PlatformQualitia - Scriptless Test Automation Platform
Qualitia - Scriptless Test Automation Platform
 
Data mining for_java_and_dot_net 2016-17
Data mining for_java_and_dot_net 2016-17Data mining for_java_and_dot_net 2016-17
Data mining for_java_and_dot_net 2016-17
 
Agile Mumbai 2019 Conference | Intelligent DevOps enabling Enterprise Agilit...
Agile Mumbai 2019 Conference |  Intelligent DevOps enabling Enterprise Agilit...Agile Mumbai 2019 Conference |  Intelligent DevOps enabling Enterprise Agilit...
Agile Mumbai 2019 Conference | Intelligent DevOps enabling Enterprise Agilit...
 
How can we use LangChain for Data Analysis_ A Detailed Perspective.pdf
How can we use LangChain for Data Analysis_ A Detailed Perspective.pdfHow can we use LangChain for Data Analysis_ A Detailed Perspective.pdf
How can we use LangChain for Data Analysis_ A Detailed Perspective.pdf
 
Big Data - Hadoop and MapReduce for QA and testing by Aditya Garg
Big Data - Hadoop and MapReduce for QA and testing by Aditya GargBig Data - Hadoop and MapReduce for QA and testing by Aditya Garg
Big Data - Hadoop and MapReduce for QA and testing by Aditya Garg
 
AyyappaKumar_AutomationTesting
AyyappaKumar_AutomationTestingAyyappaKumar_AutomationTesting
AyyappaKumar_AutomationTesting
 
Rushcode overview
Rushcode overviewRushcode overview
Rushcode overview
 
Getting start with Performance Testing
Getting start with Performance Testing Getting start with Performance Testing
Getting start with Performance Testing
 
Rpa consulting service in cognic
Rpa consulting service in cognicRpa consulting service in cognic
Rpa consulting service in cognic
 
Optimizing API Performance Testing A Comprehensive Guide
Optimizing API Performance Testing A Comprehensive GuideOptimizing API Performance Testing A Comprehensive Guide
Optimizing API Performance Testing A Comprehensive Guide
 
[Webinar] Getting started with server-side testing - presented by WiderFunnel...
[Webinar] Getting started with server-side testing - presented by WiderFunnel...[Webinar] Getting started with server-side testing - presented by WiderFunnel...
[Webinar] Getting started with server-side testing - presented by WiderFunnel...
 
2020 10-08 measuring-qualityinproduction
2020 10-08 measuring-qualityinproduction2020 10-08 measuring-qualityinproduction
2020 10-08 measuring-qualityinproduction
 
Past Experiences and Future Challenges using Automatic Performance Modelling ...
Past Experiences and Future Challenges using Automatic Performance Modelling ...Past Experiences and Future Challenges using Automatic Performance Modelling ...
Past Experiences and Future Challenges using Automatic Performance Modelling ...
 
Quality at the speed of digital
Quality   at the speed of digitalQuality   at the speed of digital
Quality at the speed of digital
 
Breaking Up the Monolith While Migrating to AWS (GPSTEC320) - AWS re:Invent 2018
Breaking Up the Monolith While Migrating to AWS (GPSTEC320) - AWS re:Invent 2018Breaking Up the Monolith While Migrating to AWS (GPSTEC320) - AWS re:Invent 2018
Breaking Up the Monolith While Migrating to AWS (GPSTEC320) - AWS re:Invent 2018
 
Quality automation at walmart scale
Quality automation at walmart scaleQuality automation at walmart scale
Quality automation at walmart scale
 

More from Postman

Elevating Developer Experiences with AI-Powered API Testing & Documentation
Elevating Developer Experiences with AI-Powered API Testing & DocumentationElevating Developer Experiences with AI-Powered API Testing & Documentation
Elevating Developer Experiences with AI-Powered API Testing & DocumentationPostman
 
Discovering Public APIs and Public API Network with Postman
Discovering Public APIs and Public API Network with PostmanDiscovering Public APIs and Public API Network with Postman
Discovering Public APIs and Public API Network with PostmanPostman
 
Optimizing Teamwork: Harnessing Collections & Workspaces for Collaboration
Optimizing Teamwork: Harnessing Collections & Workspaces for CollaborationOptimizing Teamwork: Harnessing Collections & Workspaces for Collaboration
Optimizing Teamwork: Harnessing Collections & Workspaces for CollaborationPostman
 
API testing Beyond the Basics AI & Automation Techniques
API testing Beyond the Basics AI & Automation TechniquesAPI testing Beyond the Basics AI & Automation Techniques
API testing Beyond the Basics AI & Automation TechniquesPostman
 
Five Ways to Automate API Testing with Postman
Five Ways to Automate API Testing with PostmanFive Ways to Automate API Testing with Postman
Five Ways to Automate API Testing with PostmanPostman
 
How to Scale APIs-as-Product for Future Success
How to Scale APIs-as-Product for Future SuccessHow to Scale APIs-as-Product for Future Success
How to Scale APIs-as-Product for Future SuccessPostman
 
Revolutionizing API Development: Collaborative Workflows with Postman
Revolutionizing API Development: Collaborative Workflows with PostmanRevolutionizing API Development: Collaborative Workflows with Postman
Revolutionizing API Development: Collaborative Workflows with PostmanPostman
 
Everything You Always Wanted to Know About AsyncAPI
Everything You Always Wanted to Know About AsyncAPIEverything You Always Wanted to Know About AsyncAPI
Everything You Always Wanted to Know About AsyncAPIPostman
 
Elevating Event-Driven World: A Deep Dive into AsyncAPI v3
Elevating Event-Driven World: A Deep Dive into AsyncAPI v3Elevating Event-Driven World: A Deep Dive into AsyncAPI v3
Elevating Event-Driven World: A Deep Dive into AsyncAPI v3Postman
 
Five Things You SHOULD Know About Postman
Five Things You SHOULD Know About PostmanFive Things You SHOULD Know About Postman
Five Things You SHOULD Know About PostmanPostman
 
Integration-, Snapshot- and Performance-Testing APIs
Integration-, Snapshot- and Performance-Testing APIs Integration-, Snapshot- and Performance-Testing APIs
Integration-, Snapshot- and Performance-Testing APIs Postman
 
How ChatGPT led OpenAPI's Recent Spike in Popularity
How ChatGPT led OpenAPI's Recent Spike in PopularityHow ChatGPT led OpenAPI's Recent Spike in Popularity
How ChatGPT led OpenAPI's Recent Spike in PopularityPostman
 
Exploring Postman’s VS Code Extension
Exploring Postman’s VS Code ExtensionExploring Postman’s VS Code Extension
Exploring Postman’s VS Code ExtensionPostman
 
2023 State of the API Report: Key Findings and Trends
2023 State of the API Report: Key Findings and Trends2023 State of the API Report: Key Findings and Trends
2023 State of the API Report: Key Findings and TrendsPostman
 
Nordic- APIOps is here What will you build in an API First World
Nordic- APIOps is here What will you build in an API First World Nordic- APIOps is here What will you build in an API First World
Nordic- APIOps is here What will you build in an API First World Postman
 
Testing and Developing gRPC APIs
Testing and Developing gRPC APIsTesting and Developing gRPC APIs
Testing and Developing gRPC APIsPostman
 
Testing and Developing GraphQL APIs
Testing and Developing GraphQL APIsTesting and Developing GraphQL APIs
Testing and Developing GraphQL APIsPostman
 
Introduction to API Security - Intergalactic
Introduction to API Security - IntergalacticIntroduction to API Security - Intergalactic
Introduction to API Security - IntergalacticPostman
 
Unboxing What's New in Postman Q2
Unboxing What's New in Postman Q2Unboxing What's New in Postman Q2
Unboxing What's New in Postman Q2Postman
 
Advanced Testing
Advanced TestingAdvanced Testing
Advanced TestingPostman
 

More from Postman (20)

Elevating Developer Experiences with AI-Powered API Testing & Documentation
Elevating Developer Experiences with AI-Powered API Testing & DocumentationElevating Developer Experiences with AI-Powered API Testing & Documentation
Elevating Developer Experiences with AI-Powered API Testing & Documentation
 
Discovering Public APIs and Public API Network with Postman
Discovering Public APIs and Public API Network with PostmanDiscovering Public APIs and Public API Network with Postman
Discovering Public APIs and Public API Network with Postman
 
Optimizing Teamwork: Harnessing Collections & Workspaces for Collaboration
Optimizing Teamwork: Harnessing Collections & Workspaces for CollaborationOptimizing Teamwork: Harnessing Collections & Workspaces for Collaboration
Optimizing Teamwork: Harnessing Collections & Workspaces for Collaboration
 
API testing Beyond the Basics AI & Automation Techniques
API testing Beyond the Basics AI & Automation TechniquesAPI testing Beyond the Basics AI & Automation Techniques
API testing Beyond the Basics AI & Automation Techniques
 
Five Ways to Automate API Testing with Postman
Five Ways to Automate API Testing with PostmanFive Ways to Automate API Testing with Postman
Five Ways to Automate API Testing with Postman
 
How to Scale APIs-as-Product for Future Success
How to Scale APIs-as-Product for Future SuccessHow to Scale APIs-as-Product for Future Success
How to Scale APIs-as-Product for Future Success
 
Revolutionizing API Development: Collaborative Workflows with Postman
Revolutionizing API Development: Collaborative Workflows with PostmanRevolutionizing API Development: Collaborative Workflows with Postman
Revolutionizing API Development: Collaborative Workflows with Postman
 
Everything You Always Wanted to Know About AsyncAPI
Everything You Always Wanted to Know About AsyncAPIEverything You Always Wanted to Know About AsyncAPI
Everything You Always Wanted to Know About AsyncAPI
 
Elevating Event-Driven World: A Deep Dive into AsyncAPI v3
Elevating Event-Driven World: A Deep Dive into AsyncAPI v3Elevating Event-Driven World: A Deep Dive into AsyncAPI v3
Elevating Event-Driven World: A Deep Dive into AsyncAPI v3
 
Five Things You SHOULD Know About Postman
Five Things You SHOULD Know About PostmanFive Things You SHOULD Know About Postman
Five Things You SHOULD Know About Postman
 
Integration-, Snapshot- and Performance-Testing APIs
Integration-, Snapshot- and Performance-Testing APIs Integration-, Snapshot- and Performance-Testing APIs
Integration-, Snapshot- and Performance-Testing APIs
 
How ChatGPT led OpenAPI's Recent Spike in Popularity
How ChatGPT led OpenAPI's Recent Spike in PopularityHow ChatGPT led OpenAPI's Recent Spike in Popularity
How ChatGPT led OpenAPI's Recent Spike in Popularity
 
Exploring Postman’s VS Code Extension
Exploring Postman’s VS Code ExtensionExploring Postman’s VS Code Extension
Exploring Postman’s VS Code Extension
 
2023 State of the API Report: Key Findings and Trends
2023 State of the API Report: Key Findings and Trends2023 State of the API Report: Key Findings and Trends
2023 State of the API Report: Key Findings and Trends
 
Nordic- APIOps is here What will you build in an API First World
Nordic- APIOps is here What will you build in an API First World Nordic- APIOps is here What will you build in an API First World
Nordic- APIOps is here What will you build in an API First World
 
Testing and Developing gRPC APIs
Testing and Developing gRPC APIsTesting and Developing gRPC APIs
Testing and Developing gRPC APIs
 
Testing and Developing GraphQL APIs
Testing and Developing GraphQL APIsTesting and Developing GraphQL APIs
Testing and Developing GraphQL APIs
 
Introduction to API Security - Intergalactic
Introduction to API Security - IntergalacticIntroduction to API Security - Intergalactic
Introduction to API Security - Intergalactic
 
Unboxing What's New in Postman Q2
Unboxing What's New in Postman Q2Unboxing What's New in Postman Q2
Unboxing What's New in Postman Q2
 
Advanced Testing
Advanced TestingAdvanced Testing
Advanced Testing
 

Recently uploaded

"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr BaganFwdays
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersNicole Novielli
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3
 
Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rick Flair
 
What is Artificial Intelligence?????????
What is Artificial Intelligence?????????What is Artificial Intelligence?????????
What is Artificial Intelligence?????????blackmambaettijean
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Manik S Magar
 
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESSALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESmohitsingh558521
 
Sample pptx for embedding into website for demo
Sample pptx for embedding into website for demoSample pptx for embedding into website for demo
Sample pptx for embedding into website for demoHarshalMandlekar2
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsNathaniel Shimoni
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfMounikaPolabathina
 
Ryan Mahoney - Will Artificial Intelligence Replace Real Estate Agents
Ryan Mahoney - Will Artificial Intelligence Replace Real Estate AgentsRyan Mahoney - Will Artificial Intelligence Replace Real Estate Agents
Ryan Mahoney - Will Artificial Intelligence Replace Real Estate AgentsRyan Mahoney
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays
 

Recently uploaded (20)

"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan
 
A Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software DevelopersA Journey Into the Emotions of Software Developers
A Journey Into the Emotions of Software Developers
 
How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.How AI, OpenAI, and ChatGPT impact business and software.
How AI, OpenAI, and ChatGPT impact business and software.
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptxA Deep Dive on Passkeys: FIDO Paris Seminar.pptx
A Deep Dive on Passkeys: FIDO Paris Seminar.pptx
 
Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...Rise of the Machines: Known As Drones...
Rise of the Machines: Known As Drones...
 
What is Artificial Intelligence?????????
What is Artificial Intelligence?????????What is Artificial Intelligence?????????
What is Artificial Intelligence?????????
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
 
Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!Anypoint Exchange: It’s Not Just a Repo!
Anypoint Exchange: It’s Not Just a Repo!
 
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICESSALESFORCE EDUCATION CLOUD | FEXLE SERVICES
SALESFORCE EDUCATION CLOUD | FEXLE SERVICES
 
Sample pptx for embedding into website for demo
Sample pptx for embedding into website for demoSample pptx for embedding into website for demo
Sample pptx for embedding into website for demo
 
Time Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directionsTime Series Foundation Models - current state and future directions
Time Series Foundation Models - current state and future directions
 
What is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdfWhat is DBT - The Ultimate Data Build Tool.pdf
What is DBT - The Ultimate Data Build Tool.pdf
 
Ryan Mahoney - Will Artificial Intelligence Replace Real Estate Agents
Ryan Mahoney - Will Artificial Intelligence Replace Real Estate AgentsRyan Mahoney - Will Artificial Intelligence Replace Real Estate Agents
Ryan Mahoney - Will Artificial Intelligence Replace Real Estate Agents
 
"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko"Debugging python applications inside k8s environment", Andrii Soldatenko
"Debugging python applications inside k8s environment", Andrii Soldatenko
 

Not Your Grandma’s Rate Limiting (slides)

  • 1. All rights reserved by Postman Inc Not Your Grandma’s Rate Limiting Meenakshi Dhanani Developer Relations Engineer, GraphQL
  • 2. Bonjour de l’Inde Meenakshi Dhanani (aka Meena) 󰏝 @mdhananii DEVELOPER RELATIONS ENGINEER, GRAPHQL Likes: - Yoga, strength training 󰙥 - Spanish 󰎼 “ @getpostman @mdhananii
  • 3. Introduction to Rate Limiting APIs Challenges with Rate Limiting GraphQL APIs Optimization Techniques for GraphQL APIs Real world examples Road Ahead 1 2 3 4 5 Overview @getpostman @mdhananii
  • 4. Introduction to Rate Limiting THE CONTEXT @getpostman @mdhananii
  • 5. Rate Limiting ● Minimize load Rate limiting enforces a controlled flow of requests, preventing system congestion and downtime due to excessive demand. ● Ensure fair usage Rate limiting ensures fair usage by setting predefined limits on how often each client or user can access resources, preventing any single entity from monopolizing the system's resources. Safeguards against bursts of incoming traffic @getpostman @mdhananii
  • 6. An API rate limit is essentially a way for Shopify to ensure stability of the platform Zameer Masjedee Office of the President, Technology Lead at Shopify “ @getpostman @mdhananii
  • 7. Challenges with Rate Limiting GraphQL APIs THE PROBLEM @getpostman @mdhananii
  • 10. @getpostman @mdhananii Query Cost Analysis ● Type complexity Type complexity reflects the size of the data retrieved by a query. ● Resolve complexity Resolve complexity reflects the server’s query execution cost Shopify Engineering Blog
  • 11. @getpostman @mdhananii Benefits of Cost Analysis for Service Providers ● Inform load balancing Distribute incoming queries across server instances based on their complexity, ensuring even processing and preventing overloading of resources. ● Resolver resource allocation Developers can allocate resources more effectively, optimize resolver functions, and prioritize high-impact queries, resulting in better overall performance and efficient use of server resources. ● Threat prevention Attackers are discouraged from crafting overly complex or deeply nested queries that could degrade server performance or cause denial-of-service attacks. ● Monetization Pricing based on the execution cost or response size.
  • 14. @getpostman @mdhananii Static Cost Analysis Blocks queries above a certain complexity, before they execute
  • 15. @getpostman @mdhananii Dynamic Cost Analysis Block queries above a certain complexity, during execution
  • 16. @getpostman @mdhananii Response Cost Analysis Calculates complexity after the execution, based on the response.
  • 17. @getpostman @mdhananii Key Considerations ● Introspection Queries Ensuring that introspection queries are subject to rate limiting or handled separately is crucial for security. ● Pagination Pagination arguments significantly impact cost calculation. The same field with different pagination sizes can have vastly different costs. ● Upper Bound vs Actual Response When clients request a large number of items, but the actual response contains fewer items, there's a potential mismatch between the charged cost and the delivered value ● Complexity Calculation Overhead The process of calculating query complexity itself can introduce overhead, especially for deeply nested queries.
  • 22. @getpostman @mdhananii No Right Answer Examples illustrate a good rate limiting strategy consists of not one but a combination of all these techniques.
  • 23. @getpostman @mdhananii Traditional Architecture for Rate Limiting ● Gateways/Routers API gateways can centralize the management of APIs, making it easier to control access, monitor traffic, and troubleshoot problems.
  • 25. @getpostman @mdhananii Implementation Strategies ● Compilers A compiler transforms GraphQL queries into an optimized representation. This representation can then be used to implement rate limiting more efficiently. ● Machine Learning Approach Machine learning can be used to learn the patterns of legitimate and malicious traffic. This information can then be used to optimize the rate limiting rules to better protect the API from abuse.
  • 26. During this session, we learned: ● What is rate limiting APIs? ● Why is rate limiting for GraphQL different from other APIs? ● Query cost analysis - techniques, examples ● Peek into future strategies Recap @getpostman @mdhananii
  • 28. API Rate Limits and Working with GraphQL https://www.shopify.com/partners/blog/graphql-rate-limits A Guide to GraphQL Rate Limiting and Security https://xuorig.medium.com/a-guide-to-graphql-rate-limiting-security-e62a86ef8114 Why does GraphQL need cost analysis? | Morris Matsa https://mmatsa.com/blog/why-cost-analysis/ A Principled Approach to GraphQL Query Cost Analysis https://arxiv.org/pdf/2009.05632.pdf Additional Resources @getpostman @mdhananii
  • 29. Q&A Please tell us about your experience! @getpostman @mdhananii