rust 63 lines · 10 steps

A sliding-window rate limiter in Axum

An Axum middleware that caps requests per API key using a per-key queue of timestamps within a sliding time window.

Explained by highlit
Axum Intermediate rate-limiting middleware sliding-window concurrency shared-state
1use axum::{
2 body::Body,
3 extract::State,
4 http::{Request, StatusCode},
5 middleware::Next,
6 response::Response,
7};
8use std::{
9 collections::{HashMap, VecDeque},
10 sync::Arc,
11 time::{Duration, Instant},
12};
13use tokio::sync::Mutex;
14 
15#[derive(Clone)]
16pub struct RateLimiter {
17 window: Duration,
18 max_requests: usize,
19 hits: Arc<Mutex<HashMap<String, VecDeque<Instant>>>>,
20}
21 
22impl RateLimiter {
23 pub fn new(max_requests: usize, window: Duration) -> Self {
24 Self {
25 window,
26 max_requests,
27 hits: Arc::new(Mutex::new(HashMap::new())),
28 }
29 }
30}
31 
32pub async fn rate_limit(
33 State(limiter): State<RateLimiter>,
34 request: Request<Body>,
35 next: Next,
36) -> Result<Response, StatusCode> {
37 let api_key = request
38 .headers()
39 .get("x-api-key")
40 .and_then(|v| v.to_str().ok())
41 .ok_or(StatusCode::UNAUTHORIZED)?
42 .to_owned();
43 
44 let now = Instant::now();
45 let cutoff = now - limiter.window;
46 
47 {
48 let mut hits = limiter.hits.lock().await;
49 let timestamps = hits.entry(api_key).or_default();
50 
51 while timestamps.front().is_some_and(|&t| t < cutoff) {
52 timestamps.pop_front();
53 }
54 
55 if timestamps.len() >= limiter.max_requests {
56 return Err(StatusCode::TOO_MANY_REQUESTS);
57 }
58 
59 timestamps.push_back(now);
60 }
61 
62 Ok(next.run(request).await)
63}
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1A per-key VecDeque of timestamps makes a sliding window cheap: evict from the front, count what remains, push the newest at the back.
  2. 2Sharing mutable state across async handlers needs Arc<Mutex<...>>, and holding the lock in a tight scope keeps contention low.
  3. 3Axum middleware either short-circuits with an error status or calls next.run to let the request proceed.

Related explainers

rust 
use serde::Deserialize;
 
#[derive(Debug, Deserialize)]
#[serde(untagged)]

Parsing flexible JSON shapes with serde

deserialization enums json
Intermediate 6 steps
rust 
use std::cmp::{Ordering, Reverse};
use std::collections::BinaryHeap;
use std::fs::File;
use std::io::{self, BufRead, BufReader, BufWriter, Lines, Write};

K-way merge of sorted logs in Rust

binary-heap k-way-merge streaming-io
Intermediate 8 steps
python 
import time
import uuid
 
from django.utils.deprecation import MiddlewareMixin

Attaching per-request context in Django

middleware request lifecycle multi-tenancy
Intermediate 7 steps
rust 
use axum::{
    extract::{Path, State},
    response::sse::{Event, KeepAlive, Sse},
};

Streaming import progress with SSE in Axum

server-sent-events streams watch-channel
Advanced 7 steps
rust 
use std::f64::consts::PI;
 
#[derive(Debug, Clone, Copy)]
pub struct LatLng {

Building geographic bounding boxes in Rust

geospatial value-types option
Intermediate 7 steps
go 
func (w *Watcher) resetDebounce(d time.Duration) {
	if !w.timer.Stop() {
		select {
		case <-w.timer.C:

Debouncing a stream of events in Go

debounce timers channels
Advanced 7 steps

Share this explainer

Here's the card — post it anywhere.

A sliding-window rate limiter in Axum — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code