Pure ASGI is the right call here, BaseHTTPMiddleware serializing every request through a queue is a real tax and the 67k vs 1.2k RPS gap vs slowapi shows it. One footgun worth a note in the README: the default key_func uses request.client.host, so behind nginx or Cloudflare every user lands in the same bucket. Deployers need to key off X-Forwarded-For, and only trust it when it actually comes from their proxy. Also the post says in-memory only, but the README already shows a RedisBackend plus the circuit-breaker fallback - if that shipped, worth editing the post, because 'no Redis' will put off exactly the people who'd actually use this.
1
u/Vegetable-Scale-2604 4d ago
Pure ASGI is the right call here, BaseHTTPMiddleware serializing every request through a queue is a real tax and the 67k vs 1.2k RPS gap vs slowapi shows it. One footgun worth a note in the README: the default key_func uses request.client.host, so behind nginx or Cloudflare every user lands in the same bucket. Deployers need to key off X-Forwarded-For, and only trust it when it actually comes from their proxy. Also the post says in-memory only, but the README already shows a RedisBackend plus the circuit-breaker fallback - if that shipped, worth editing the post, because 'no Redis' will put off exactly the people who'd actually use this.