Jump to content
Welcome to our new Citrix community!

  • Use Case: Remote Rate Limiting rules with HTTP Callout

    Rick Davis

    By Rick Davis

      • Validation Status: Validated
      Summary: In general, as request load increases, compute capacity can be scaled to meet demand as needed. However, not all back-end systems are so easily scaled. Sometimes even a moderate traffic load increase for a resource-constrained service could make it unresponsive. NetScaler rate limiting can protect services through the enforcement of flexible traffic quotas. This HTTP Callout based use case is helpful where service capacity may be different among tenants and/or application resources and the rule set for when to apply rate limiting quotas is managed by an external API server.
      Has Video?: No
     Share

    This use case provides Rate Limiting of traffic by using an HTTP Callout to get the designated rate tier for a Tenant API key and resource.

     

    In general, as request load increases, compute capacity can be scaled to meet demand as needed.  However, not all back-end systems are so easily scaled.  Sometimes even a moderate traffic load increase for a resource-constrained service could make it unresponsive.  NetScaler rate limiting can protect services through the enforcement of flexible traffic quotas.  This HTTP Callout based use case is helpful where service capacity may be different among tenants and/or application resources and the rule set for when to apply rate limiting quotas is managed by an external API server.

     

    Communication flow overview

    image.jpg.b5aad3e58e8952678f6816b1c1b47480.jpg
    1. Client sends request for http://app1.demo.com/dtu560m5-cn4v-bqex-5vl1-9ywz4748hcji/product?itemid=3944
    2. NetScaler sends the tenant key, and the resource requested, to the API server which responds with the desired rate tier.
    3. When the client reaches its tier threshold, the NetScaler responds to the client with a 429 "Too Many Requests" response.

    Configuration Steps

     

    1. Define the tenant key and resource locations
    NetScaler can track a tenant key from anywhere in the request so use the appropriate AppExpert expression for your application.  For this example, the key is the first folder of the URI and the resource is in the second folder: https://app1.demo.com/dtu560m5-cn4v-bqex-5vl1-9ywz4748hcji/product?itemid=3944
    add ns expression m_api_key HTTP.REQ.URL.PATH.GET(1)

    add ns expression m_resource HTTP.REQ.URL.PATH.GET(2)

     
    1. Create the rate limiting service tiers (8000 rpm, 3000 rpm, 200 rpm)

      In this example, we will offer 3 tiers of service limiting the number of requests per second each tenant key can make for a given resource.  

      Different Tenants can share rate tiers because the stream selector in this example designates each tenants API key is to be tracked independently within the limit identifier.
    add stream selector m_8000pm m_api_key

    add ns limitIdentifier m_8000pm -threshold 8000 -timeSlice 60000 -mode REQUEST_RATE -limitType BURSTY -selectorName m_8000pm

    add stream selector m_3000pm m_api_key

    add ns limitIdentifier m_3000pm -threshold 3000 -timeSlice 60000 -mode REQUEST_RATE -limitType BURSTY -selectorName m_3000pm

    add stream selector m_200pm m_api_key

    add ns limitIdentifier m_200pm -threshold 200 -timeSlice 60000 -mode REQUEST_RATE -limitType BURSTY -selectorName m_200pm

     

    1. Create an HTTP callout.
    add policy httpCallout http_callout1

     

    1. Configure the HTTP callout to receive the Rate Limit service tier name (aka Limit ID) based on the API key used and resource requested.
    set policy http_callout1 m_rate_limit_query -IPAddress 10.217.14.23 -port 80 -returnType TEXT -hostExpr "\"apiserver\"" -urlStemExpr "\"/service_level\"" -parameters id2(m_resource) id1(m_api_key) -scheme http -resultExpr "HTTP.RES.BODY(10000).XPATH_JSON(xp%//service%)" -cacheForSecs 31536000

     

     

    Example HTTP Callout and Server response:
    > GET /service_level?id1=dtu560m5-cn4v-bqex-5vl1-9ywz4748hcji&id2=product HTTP/1.1

    > Host: apiserver

    >

    < HTTP/1.1 200 OK

    < Content-Type: application/json; charset=utf-8

    <

    [{

        "id1": "dtu560m5-cn4v-bqex-5vl1-9ywz4748hcji",

        "service": "m_200pm"

    }]

    TIP:  Use the Expression Evaluator to help you craft the correct AppExpert policy:

    image.jpg.7c5c9ee142bb575a88b708ed0941c387.jpg

     

    1. Configure a 429 response message to use when the limit is reached.
    import responder htmlpage https://raw.githubusercontent.com/rd636/429/main/429_message_body m_429_body

    add responder action m_429 respondwithhtmlpage m_429_body -responseStatusCode 429 -reasonPhrase q{"Too Many Requests"}

     

    image.jpg.e355800744d056d1de8c315b38b7912a.jpg

     

    1. Configure the responder policies.
    add responder policy m_8000pm "SYS.HTTP_CALLOUT(m_rate_limit_query).CONTAINS(\"m8000pm\") && SYS.CHECK_LIMIT(\"m_8000pm\")" m_429

    add responder policy m_3000pm "SYS.HTTP_CALLOUT(m_rate_limit_query).CONTAINS(\"m3000pm\") && SYS.CHECK_LIMIT(\"m_3000pm\")" m_429

    add responder policy m_200pm "SYS.HTTP_CALLOUT(m_rate_limit_query).CONTAINS(\"m200pm\") && SYS.CHECK_LIMIT(\"m_8000pm\")" m_429

     

    1. Binding the policies.
    bind responder global m_200pm 100 END -type REQ_OVERRIDE

    bind responder global m_3000pm 110 END -type REQ_OVERRIDE

    bind responder global m_8000pm 120 END -type REQ_OVERRIDE

     

     
    Validating
    • View the traffic rates
    The rate statistics are maintained in the limit identifier that you named in the rule for the rate-based policy.   You should see your tenant key in the hash string.  Each unique key will have its own entry.
    show ns limitSessions m_200pm

     

    image.jpg.0d6bf08823c2192cbdb2af60c1b52874.jpg

    image.jpg.05bf7e1dcd611f5283a57839863031a4.jpg

     
    • View the Cached Callout Response
    To optimize performance, each successful callout request/response is cached in-memory. 
    show cache object

     

    image.jpg.162f7615234aa65a00f458a08871f0f7.jpgimage.jpg.b1ac164f86128e5ca55552957afa2ea0.jpg

     

    References

     
     
     
     Share
    Go to articles

    User Feedback

    Recommended Comments

    There are no comments to display.



    Create an account or sign in to comment

    You need to be a member in order to leave a comment

    Create an account

    Sign up for a new account in our community. It's easy!

    Register a new account

    Sign in

    Already have an account? Sign in here.

    Sign In Now

© Cloud Software Group, Inc. All rights reserved.

×
×
  • Create New...