[Django] How to limit requests per minute per user?

Question

I Have several forms in my website and I have several pages with intense database activity. I want to set a cap on requests per user. For example, I don't want people to make over 10 requests in less than 10 seconds.

Is there way to do this in Django?

Answer 1

You can likely do this with custom middleware. You'll need to keep the data somewhere (db?). See the docs for how to write your own middleware. Here's what's available to you in the request object.

I'd recommend doing this on apache/nginx/whatever you're using, though.

Answer 2

Have a look at Simon Willison's ratelimitcache. Like the name implies, it uses Django's cache framework to store the state of the rate limiter. There's also a blog post that details how the rate limiter works.