asgi-ratelimit

What it is and what it does

asgi-ratelimit is an ASGI middleware that sits between your web application and incoming requests, enforcing rate limits based on user identity and group membership. It lets you define rules that restrict how often a user can hit specific endpoints—for example, allowing 1 request per second to one endpoint and 1 per minute to another—with different limits for different user groups like admins. The middleware can use an in-memory backend for simple cases or Redis for distributed setups.

You configure it with regex patterns matching your routes and Rule objects specifying time windows (second, minute, day) and optional group names. When a user exceeds the limit, the middleware returns HTTP 429 and blocks further requests for a configurable period. It requires you to provide an authentication function that extracts the user ID and group from the ASGI scope—the package includes built-in helpers for IP-based, session-based, and JWT-based identification.

Use it for:

• Protect API endpoints from abuse by limiting requests per user to a fixed rate per second or minute.
• Implement tiered access where admin users get higher rate limits than regular users on the same endpoint.
• Share rate-limit budgets across multiple related endpoints using the zone parameter.
• Customize 429 responses with your own handler to return application-specific error messages.
• Use Redis backend to enforce consistent rate limits across multiple application instances.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

An ASGI middleware that enforces rate limits on HTTP requests by user or group, with support for multiple time windows, regex-based routing, and pluggable backends like memory or Redis.

Yes, with conditions. Install if you need straightforward per-user rate limiting on an ASGI app and can accept that the package is no longer actively maintained (last release 2022-12-07). The low install friction, permissive license, and zero known vulnerabilities make it safe to add. However, verify compatibility with your specific ASGI framework version and Python release, and plan for potential maintenance burden if you need to patch it yourself.

Install

asgi-ratelimit on PyPI

pip install asgi-ratelimit

uv add asgi-ratelimit

poetry add asgi-ratelimit

Installing asgi-ratelimit

Before you install

Low install friction; pure Python wheel with only dataclasses as a runtime dependency. Maintenance is dormant—last release was 2022-12-07, though the repository remains active. Suitable for projects that can tolerate no further updates.

License in practice

Apache-2.0 permissive license allows commercial use, modification, and distribution with minimal restrictions, making it safe for most projects.

Quickstart

pip install asgi-ratelimit

from ratelimit import RateLimitMiddleware, Rule
from ratelimit.backends.simple import MemoryBackend

rate_limit = RateLimitMiddleware(
    app,
    auth_function,
    MemoryBackend(),
    {r"^/endpoint": [Rule(second=1, group="default")]}
)

Requires an ASGI application and an async authentication function that returns (user_id, group_name) tuple from the ASGI scope.

Verify before relying

• Whether dormant maintenance status poses compatibility risks with modern ASGI frameworks or Python versions.
• Performance characteristics under high concurrency or with large numbers of concurrent users.
• Whether Redis backend requires additional setup or configuration beyond the redis.asyncio dependency.

Package facts

Evidence: asgi_ratelimit-0.10.0-py3-none-any.whl

Tags

More WWW/HTTP packages