Fixed Window Rate Limiting: Concept, Examples, and Java Implementation

import java.time.Duration; import java.util.Map; import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.atomic.AtomicInteger; /** * Single-machine Fixed Window Rate Limiter. * Thread-safe implementation for small-scale services. */ public class FixedRateLimiter implements IRateLimiter { private final Timer timer; // Provides current time (injectable for testing) private final Map<String, FixedWindow> map; // Stores request counts per user/requestId private final Duration windowSize; // Size of fixed time window private final int capacity; // Max requests per window public FixedRateLimiter(Duration windowSize, int capacity, Timer timer) { this.timer = timer; this.map = new ConcurrentHashMap<>(); this.windowSize = windowSize; this.capacity = capacity; } /** * Checks if a request is allowed for the given requestId. * * @param requestId Unique identifier for a client/user * @return true if allowed, false if rate limit exceeded */ @Override public boolean isAllowed(String requestId) { long currentTimeMillis = timer.currentTimeMillis(); // Get or create FixedWindow for this requestId FixedWindow fixedWindow = map.computeIfAbsent( requestId, e -> new FixedWindow(new AtomicInteger(capacity), currentTimeMillis) ); // Reset window if current time exceeds previous window if (currentTimeMillis - fixedWindow.lastAccessTime > windowSize.toMillis()) { synchronized (fixedWindow) { if (currentTimeMillis - fixedWindow.lastAccessTime > windowSize.toMillis()) { fixedWindow.lastAccessTime = currentTimeMillis; fixedWindow.requestCount.set(capacity); // Reset request count } } } // Allow request if capacity remains int remaining = fixedWindow.requestCount.get(); if (remaining > 0) { fixedWindow.requestCount.decrementAndGet(); return true; } return false; // Deny if limit reached } /** * Internal class to hold request count and last access time per window. */ private static class FixedWindow { final AtomicInteger requestCount; // Tracks remaining requests volatile long lastAccessTime; // Timestamp of window start FixedWindow(AtomicInteger requestCount, long lastAccessTime) { this.requestCount = requestCount; this.lastAccessTime = lastAccessTime; } } /** * Timer abstraction for easy testing (injectable current time provider) */ public record Timer() { public long currentTimeMillis() { return System.currentTimeMillis(); } } } 

import redis.clients.jedis.Jedis; import redis.clients.jedis.JedisPool; /** * Distributed Fixed Window Rate Limiter using Redis. * Suitable for multi-instance applications. */ public class RedisFixedRateLimiter { private final JedisPool jedisPool; // Redis connection pool private final String rateLimitKeyPrefix; // Prefix for Redis keys, e.g., "rate_limit:" private final int maxRequestsPerWindow; // Max requests allowed per window private final int windowDurationInSeconds; // Window size in seconds public RedisFixedRateLimiter(JedisPool jedisPool, String rateLimitKeyPrefix, int maxRequestsPerWindow, int windowDurationInSeconds) { this.jedisPool = jedisPool; this.rateLimitKeyPrefix = rateLimitKeyPrefix; this.maxRequestsPerWindow = maxRequestsPerWindow; this.windowDurationInSeconds = windowDurationInSeconds; } /** * Checks if a request is allowed for a given userId. * * @param userId Unique identifier for the client/user * @return true if request is allowed, false if rate limit exceeded */ public boolean isRequestAllowed(String userId) { String key = rateLimitKeyPrefix + userId; try (Jedis jedis = jedisPool.getResource()) { // Atomically increment the request count in Redis long currentCount = jedis.incr(key); // Set expiration only for the first request in the window if (currentCount == 1) { jedis.expire(key, windowDurationInSeconds); } // Allow if count does not exceed the maximum return currentCount <= maxRequestsPerWindow; } catch (Exception e) { // Fail-open: allow requests if Redis is unavailable e.printStackTrace(); return true; } } }