Fix API Rate Limit Exhaustion in Spring WebFlux

Rate limit exhaustion in Spring WebFlux allows attackers to trigger Denial of Service (DoS) by saturating the Netty event loop or exhausting downstream resources. Because WebFlux is non-blocking, a high volume of requests won't necessarily block threads, but it will consume heap memory and CPU cycles for object allocation and processing logic. To mitigate this, you must implement a non-blocking rate limiter at the WebFilter level using the Token Bucket algorithm.

The Vulnerable Pattern

@RestController
public class DataController {
    @GetMapping("/api/resource")
    public Mono getResource() {
        // VULNERABLE: No throttling mechanism. 
        // An attacker can flood this endpoint to exhaust CPU/Memory.
        return Mono.just("Sensitive Data");
    }
}

The Secure Implementation

The vulnerable code lacks request validation, allowing an unbounded number of Mono pipelines to be instantiated. The secure implementation introduces a 'RateLimitingFilter' using the Bucket4j library. By intercepting the 'ServerWebExchange' before it reaches the controller, we apply the Token Bucket algorithm. If the bucket is empty, we return a 429 status code without executing the expensive business logic, effectively protecting the application from resource exhaustion and ensuring the event loop remains responsive.

@Component
public class RateLimitingFilter implements WebFilter {
    private final Bucket bucket;
public RateLimitingFilter() {
    // Define 10 requests per minute limit
    Bandwidth limit = Bandwidth.classic(10, Refill.intervally(10, Duration.ofMinutes(1)));
    this.bucket = Bucket4j.builder().addLimit(limit).build();
}

@Override
public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
    if (bucket.tryConsume(1)) {
        return chain.filter(exchange);
    }
    // Shed load immediately with 429 Too Many Requests
    exchange.getResponse().setStatusCode(HttpStatus.TOO_MANY_REQUESTS);
    return exchange.getResponse().setComplete();
}
}