Apidays Paris 2023 - Software and APIs for Smart, Sustainable and Sovereign Societies December 6, 7 & 8, 2023 Not Your Grandma’s Rate Limiting Meenakshi Dhanani, Developer Relations Engineer, GraphQL at Postman ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

1. All rights reserved by Postman Inc
Not Your Grandma’s
Rate Limiting
Meenakshi Dhanani
Developer Relations Engineer,
GraphQL

2. Bonjour de l’Inde
Meenakshi Dhanani (aka Meena) 󰏝
@mdhananii
DEVELOPER RELATIONS ENGINEER, GRAPHQL
Likes:
- Yoga, strength training 󰙥
- Spanish 󰎼
“
@getpostman @mdhananii

3. Introduction to Rate Limiting APIs
Challenges with Rate Limiting GraphQL APIs
Optimization Techniques for GraphQL APIs
Real world examples
Road Ahead
1
2
3
4
5
Overview
@getpostman @mdhananii

4. Introduction to
Rate Limiting
THE CONTEXT
@getpostman @mdhananii

5. Rate Limiting
● Minimize load
Rate limiting enforces a controlled flow of
requests, preventing system congestion and
downtime due to excessive demand.
● Ensure fair usage
Rate limiting ensures fair usage by setting
predefined limits on how often each client or user
can access resources, preventing any single
entity from monopolizing the system's resources.
Safeguards against bursts of incoming traffic
@getpostman @mdhananii

6. An API rate limit is essentially a
way for Shopify to ensure
stability of the platform
Zameer Masjedee
Office of the President, Technology Lead at Shopify
“
@getpostman @mdhananii

7. Challenges with
Rate Limiting
GraphQL APIs
THE PROBLEM
@getpostman @mdhananii

8. @getpostman @mdhananii

9. Optimizing for
GraphQL
THE SOLUTION
@getpostman @mdhananii

10. @getpostman @mdhananii
Query Cost Analysis
● Type complexity
Type complexity reflects the size of the data retrieved
by a query.
● Resolve complexity
Resolve complexity reflects the server’s query
execution cost
Shopify Engineering Blog

11. @getpostman @mdhananii
Benefits of Cost Analysis for Service Providers
● Inform load balancing
Distribute incoming queries across server instances
based on their complexity, ensuring even processing
and preventing overloading of resources.
● Resolver resource allocation
Developers can allocate resources more effectively,
optimize resolver functions, and prioritize high-impact
queries, resulting in better overall performance and
efficient use of server resources.
● Threat prevention
Attackers are discouraged from crafting overly
complex or deeply nested queries that could degrade
server performance or cause denial-of-service
attacks.
● Monetization
Pricing based on the execution cost or response size.

12. @getpostman @mdhananii
Query Cost vs Execution Time

13. Query Cost
Analysis
Techniques
THE HOW
@getpostman @mdhananii

14. @getpostman @mdhananii
Static Cost Analysis
Blocks queries above a certain complexity, before they execute

15. @getpostman @mdhananii
Dynamic Cost Analysis
Block queries above a certain complexity, during execution

16. @getpostman @mdhananii
Response Cost Analysis
Calculates complexity after the execution, based on the response.

17. @getpostman @mdhananii
Key Considerations
● Introspection Queries
Ensuring that introspection queries are subject to rate
limiting or handled separately is crucial for security.
● Pagination
Pagination arguments significantly impact cost
calculation. The same field with different pagination
sizes can have vastly different costs.
● Upper Bound vs Actual Response
When clients request a large number of items, but the
actual response contains fewer items, there's a
potential mismatch between the charged cost and the
delivered value
● Complexity Calculation Overhead
The process of calculating query complexity itself can
introduce overhead, especially for deeply nested
queries.

18. Examples
REAL WORLD SCHEMAS
@getpostman @mdhananii

19. @getpostman @mdhananii
Shopify Query Cost Analysis

20. @getpostman @mdhananii
GitHub Query Cost Analysis

21. @getpostman @mdhananii
Yelp Query Cost Analysis

22. @getpostman @mdhananii
No Right Answer
Examples illustrate a good rate limiting strategy
consists of not one but a combination of all these
techniques.

23. @getpostman @mdhananii
Traditional Architecture for Rate Limiting
● Gateways/Routers
API gateways can centralize the management
of APIs, making it easier to control access,
monitor traffic, and troubleshoot problems.

24. Road Ahead
@getpostman @mdhananii
SNEAK PEEK INTO THE FUTURE

25. @getpostman @mdhananii
Implementation Strategies
● Compilers
A compiler transforms GraphQL queries into an
optimized representation. This representation can
then be used to implement rate limiting more
efficiently.
● Machine Learning Approach
Machine learning can be used to learn the patterns of
legitimate and malicious traffic. This information can
then be used to optimize the rate limiting rules to
better protect the API from abuse.

26. During this session, we learned:
● What is rate limiting APIs?
● Why is rate limiting for GraphQL different from other APIs?
● Query cost analysis - techniques, examples
● Peek into future strategies
Recap
@getpostman @mdhananii

27. GraphQL Concepts
@getpostman @mdhananii

28. API Rate Limits and Working with GraphQL
https://www.shopify.com/partners/blog/graphql-rate-limits
A Guide to GraphQL Rate Limiting and Security
https://xuorig.medium.com/a-guide-to-graphql-rate-limiting-security-e62a86ef8114
Why does GraphQL need cost analysis? | Morris Matsa
https://mmatsa.com/blog/why-cost-analysis/
A Principled Approach to GraphQL Query Cost Analysis
https://arxiv.org/pdf/2009.05632.pdf
Additional Resources
@getpostman @mdhananii

29. Q&A
Please tell us about your
experience!
@getpostman @mdhananii

30. Thank You
@getpostman @mdhananii