[feature] Support rate limiting through policy_effect extension

Open
#1,672 0 comments 0 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

Assessment

This issue has not been assessed yet.

Description

enhancement

It would be great if Casbin could support rate limiting natively by extending the policy_effect expression and implementing a custom Effector.

The idea is to introduce a new rate_limit function in policy_effect like this:

[policy_effect]
e = rate_limit(10, minute, allow, sub)

This means "allow at most 10 requests per minute, only count allowed requests, and bucket by subject". The four parameters are:

  • max: maximum request count within the time window
  • unit: time window unit, could be second, minute, hour, or day
  • count_type: either allow (only count allowed requests) or all (count all requests including denied ones, useful for preventing brute-force attacks)
  • bucket: the field(s) to group by, such as all, sub, obj, act

A RateLimitEffector implementing the Effector interface would parse this expression, maintain internal bucket states (counters and window timestamps), and decide whether to allow or deny based on current count. The bucket key is generated from the request context according to the bucket type, for example sub:alice when bucket is sub.

To implement this, we need to extend the policy_effect expression parser to recognize the rate_limit function, create a new RateLimitEffector that implements the Effector interface with internal state management, and make sure the enforce context (sub, obj, act) is passed to the effector so it can generate proper bucket keys.

Dominant language
Go
Stars
20.4k
Forks
1.8k
Avg merge
5d 11h
Merged PRs (30d)
2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/casbin

All issues in apache/casbin

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.