Fix API Rate Limit Exhaustion in Actix Web

API Rate Limit Exhaustion is a critical vulnerability that allows attackers to perform Denial of Service (DoS) attacks or brute-force endpoints by flooding the server with requests. In the Actix Web ecosystem, failing to implement middleware-level throttling means every request hits your business logic and database, leading to rapid resource depletion and potential service outages.

The Vulnerable Pattern

use actix_web::{get, App, HttpResponse, HttpServer, Responder};
#[get(“/api/resource”)]
async fn public_api() -> impl Responder {
// Vulnerable: No rate limiting logic.
// An attacker can spam this endpoint to exhaust worker threads or DB connections.
HttpResponse::Ok().body(“Data delivered”)
}
#[actix_web::main]
async fn main() -> std::io::Result<()> {
HttpServer::new(|| {
App::new().service(public_api)
})
.bind((“127.0.0.1”, 8080))?
.run()
.await
}

The Secure Implementation

The secure implementation leverages `actix-extensible-rate-limit` to intercept requests before they reach the handler. We utilize an `InMemoryBackend` to store request counts and a `SimpleInputFunctionBuilder` to identify clients by their real IP address. The policy restricts users to 10 requests per minute. Once the threshold is crossed, the middleware automatically returns a '429 Too Many Requests' response, shielding the application logic from overhead. The `.add_headers()` call ensures 'X-RateLimit' headers are sent, notifying well-behaved clients of their remaining quota.

use actix_web::{get, App, HttpResponse, HttpServer, Responder};
use actix_extensible_rate_limit::{
    backend::memory::InMemoryBackend,
    backend::SimpleInputFunctionBuilder,
    RateLimiter,
};
use std::time::Duration;
#[get(“/api/resource”)]
async fn public_api() -> impl Responder {
HttpResponse::Ok().body(“Data delivered”)
}
#[actix_web::main]
async fn main() -> std::io::Result<()> {
// 1. Initialize an in-memory storage backend for tracking hits
let backend = InMemoryBackend::builder().build();
HttpServer::new(move || {
    // 2. Define limit: 10 requests per 60 seconds per IP
    let input = SimpleInputFunctionBuilder::new(Duration::from_secs(60), 10)
        .real_ip_key()
        .build();

    // 3. Construct middleware
    let middleware = RateLimiter::builder(backend.clone(), input)
        .add_headers()
        .build();

    App::new()
        .wrap(middleware)
        .service(public_api)
})
.bind(("127.0.0.1", 8080))?
.run()
.await
}

Protect your Actix Web API

Don't rely on manual checks. GuardAPI's Gemini 3 Pro engine detects API Rate Limit Exhaustion and logic flaws in seconds.

Run Automated Audit

The Vulnerable Pattern

The Secure Implementation

Protect your Actix Web API

Verified by Ghost Labs Security Team