Tomcat – How to rate limit hits to a Tomcat app

apache-2.2rate-limitingtomcat

We have a Java app I'm serving from Apache 2.2 + mod_proxy_ajp + Tomcat 6 that is a REST API and end users tend to like to totally slam it as fast as they can. I'd like to be able to throttle the hits per second, ideally by user/IP, to it. Like how Amazon, Twitter, etc. rate limits hits to their APIs.

Preferably in Apache or Tomcat itself, but in the OS (Fedora) is ok, although I don't want to affect the other Tomcat apps on the same box (so just doing iptables on port 80 isn't the best solution)
I don't want to limit bandwidth, this app doesn't produce more than 1k of output per hit, just the raw number of hits to the app to protect Tomcat from being overwhelmed
I'm running on Amazon AWS EC2 so no multiple IPs per box or other complicated networking solutions
I'm open to solutions I can tell the developers to put into their code, but would like it to be something I can control from an admin point of view (like I can change log levels using their log4j config files).

Seems like all the Apache modules to do stuff like that are all abandoned and not Apache 2.2 compatible. Ideas?

Best Answer

Take a look at mod_limitipconn2, it might be what you're after:

http://dominia.org/djao/limitipconn2.html

This would allow you to limit it to one connection per IP, effectively turning the user's browser into a synchronous connection instead of it opening the usual 4-6 (thinking Firefox) by default.

Related Solutions

Apache – How to Set Up mod_proxy_ajp with Apache and Tomcat

You shouldn't need to make any changes to the server.xml except to put Tomcat back to the default ports so Apache can handle port 80. The bulk of the work will be done through the Apache configuration files. I typically leave these outside of the httpd.conf and instead stick them into smaller config snippets under the <ServerRoot>/conf.d/ sub-directory.

Given your example of ourserver.ourcompany.com/app1 & ourserver.ourcompany.com/app2 I would I would assume a configuration something along the following:

<VirtualHost *:80>
    ServerName ourserver.ourcompany.com
    ErrorLog ...
    CustomLog ...

    [other VHost configurations]

    ProxyPass /app1 ajp://tomcat_hostname:8009/app1
    ProxyPassReverse /app1 ajp://tomcat_hostname:8009/app1

    ProxyPass /app2 ajp://tomcat_hostname:8009/app2
    ProxyPassReverse /app2 ajp://tomcat_hostname:8009/app2
</VirtualHost>

If you have multiple Tomcat servers clustered behind then you might want to look at setting up mod_balancer and moving the ajp:// to mod_balancer BalancerMember's and replace with the balancer:// URL that refers to the balancer configuration.

Tomcat – Pretty URLs when using Tomcat behind an Apache proxy

If you're rewriting everything to a common location, you would typically do something like this:

ProxyPass        / http://localhost:8080/foo/
ProxyPassReverse / http://localhost:8080/foo/

If you need different rules for different paths, you would probably use the Proxy flag on a series of RewriteRules:

RewriteRule /bar/(.*) http://localhost:8080/foo/app/bar/$1 [P]
RewriteRule /api/qux/(.*) http://localhost:8080/foo/api/qux/$1 [P]
RewriteRule /quux/(.*) http://localhost:8080/foo/quux/$1 [P]
RewriteRule /(.*) http://localhost:8080/foo/app/$1 [P]

The this will send things to the appropriate place in Tomcat.

The only complication is if the application dynamically generates URLs with fully qualified paths. In this case, you need to either fix the application, or use something like mod_proxy_html to rewrite links in your HTML content.

Related Topic