Implementing API Rate Limiting

<dependency>
  <groupId>com.bucket4j</groupId>
  <artifactId>bucket4j_jdk17-core</artifactId>
  <version>8.10.1</version>
</dependency>

Bucket bucket = Bucket.builder()
  .addLimit(Bandwidth.builder().capacity(100).refillIntervally(100, Duration.ofMinutes(1)).build())
  .build();

@Component
public class RateLimitFilter extends OncePerRequestFilter {
  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();
  @Override protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
      throws IOException, ServletException {
    Bucket b = buckets.computeIfAbsent(key(req), k -> newBucket());
    ConsumptionProbe probe = b.tryConsumeAndReturnRemaining(1);
    if (probe.isConsumed()) {
      res.addHeader("X-RateLimit-Remaining", String.valueOf(probe.getRemainingTokens()));
      chain.doFilter(req, res);
    } else {
      res.setStatus(429);
      res.addHeader("Retry-After", String.valueOf(probe.getNanosToWaitForRefill() / 1_000_000_000));
    }
  }
  private String key(HttpServletRequest r) { return r.getRemoteAddr(); }
  private Bucket newBucket() { /* see 49.2 */ return null; }
}

<dependency>
  <groupId>com.bucket4j</groupId>
  <artifactId>bucket4j_jdk17-redis-common</artifactId>
</dependency>
<dependency>
  <groupId>com.bucket4j</groupId>
  <artifactId>bucket4j_jdk17-lettuce</artifactId>
</dependency>

private String key(HttpServletRequest r) {
  Authentication auth = SecurityContextHolder.getContext().getAuthentication();
  return (auth != null && auth.isAuthenticated()) ? "user:" + auth.getName() : "ip:" + r.getRemoteAddr();
}

private static final Map<String, Bandwidth> LIMITS = Map.of(
  "/api/auth/login",  Bandwidth.simple(5,  Duration.ofMinutes(1)),
  "/api/search",      Bandwidth.simple(60, Duration.ofMinutes(1)),
  "/api/orders",      Bandwidth.simple(120,Duration.ofMinutes(1))
);

res.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
res.setContentType("application/problem+json");
res.getWriter().write("""
  {"type":"https://example.com/rate-limit","title":"Too Many Requests","status":429}
  """);

@Test void exceedsLimit() throws Exception {
  for (int i = 0; i < 100; i++)
    mvc.perform(get("/api/data")).andExpect(status().isOk());
  mvc.perform(get("/api/data"))
     .andExpect(status().isTooManyRequests())
     .andExpect(header().exists("Retry-After"));
}