How to fix API Rate Limit Exhaustion
in Salvo
Executive Summary
Salvo's performance is top-tier, but raw speed is a liability if your endpoints are wide open to resource exhaustion. Without explicit rate limiting, an attacker can hammer your API with thousands of concurrent requests, leading to thread pool starvation or database connection exhaustion. In this guide, we'll implement the 'salvo::rate_limiter' middleware to drop abusive traffic at the edge before it hits your expensive business logic.
The Vulnerable Pattern
use salvo::prelude::*;#[handler] async fn sensitive_data() -> &‘static str { “This endpoint is wide open to DoS and brute force.” }
#[tokio::main] async fn main() { let router = Router::new().path(“api/v1/data”).get(sensitive_data); let acceptor = TcpListener::new(“127.0.0.1:5800”).bind().await; Server::new(acceptor).serve(router).await; }
The Secure Implementation
The secure implementation introduces the 'RateLimiter' middleware using a 'FixedWindowQuota' strategy. We use 'RemoteIpIssuer' to track unique users by their IP address. When a client exceeds the threshold (10 requests/min), Salvo automatically intercepts the request and returns a '429 Too Many Requests' response. By calling '.with_skipped_header(true)', we expose standard 'X-RateLimit' headers, allowing legitimate clients to back off gracefully before getting blocked.
use salvo::prelude::*; use salvo::rate_limiter::*; use std::time::Duration;#[handler] async fn sensitive_data() -> &‘static str { “Access restricted by rate limiter.” }
#[tokio::main] async fn main() { // Define a FixedWindow quota: 10 requests per 60 seconds per IP let limiter = RateLimiter::new( FixedWindowQuota::new(10, Duration::from_secs(60)), RemoteIpIssuer, ).with_skipped_header(true);
let router = Router::new() .push( Router::with_path("api/v1/data") .hoop(limiter) .get(sensitive_data) ); let acceptor = TcpListener::new("127.0.0.1:5800").bind().await; Server::new(acceptor).serve(router).await;
}
Your Salvo API
might be exposed to API Rate Limit Exhaustion
74% of Salvo apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.