drogue¶

Rate limiting and DDoS protection for Python web applications. Clean APIs, WebSocket support, and built-in defense layers.

Read the documentation

What problem does drogue solve?¶

Web applications need rate limiting to prevent abuse, but existing solutions have gaps:

Signature pollution -- Most rate limiters force request: Request into every function signature, coupling your business logic to the rate limiter.
No WebSocket protection -- Real-time applications using WebSockets have no built-in rate limiting.
No DDoS detection -- Simple counters catch over-use, but cannot detect distributed attacks where each client stays below the limit.
No trust differentiation -- Every request goes through the same evaluation path, even for verified users.

drogue addresses all four. It rate-limits by identity (IP, user, header) without touching your function signatures, detects anomalous traffic patterns, and fast-tracks trusted clients.

Quick start¶

FastAPI¶

from fastapi import FastAPI
from drogue.adapters.fastapi import DrogueLimiter

app = FastAPI()
limiter = DrogueLimiter(app, default_limits=["100/minute"])

@app.get("/api/data")
@limiter.limit("10/minute")
async def get_data():
    return {"data": "value"}

Flask¶

from flask import Flask
from drogue.adapters.flask import DrogueLimiter

app = Flask(__name__)
limiter = DrogueLimiter(app, default_limits=["100/minute"])

@app.route("/api/data")
@limiter.limit("10/minute")
def get_data():
    return {"data": "value"}

Django¶

# settings.py
MIDDLEWARE = [
    "drogue.adapters.django.DrogueMiddleware",
]

# views.py
from drogue.adapters.django import DrogueRateLimiter
from django.http import JsonResponse

limiter = DrogueRateLimiter()

@limiter.limit("10/minute")
def get_data(request):
    return JsonResponse({"data": "value"})

Example responses¶

Successful request¶

{
    "data": "value"
}

Headers:

X-RateLimit-Limit: 10
X-RateLimit-Remaining: 9
X-RateLimit-Reset: 1690000060

Rate limited (429)¶

{
    "error": "Rate limit exceeded",
    "message": "Too many requests. Try again in 30 seconds.",
    "retry_after": 30,
    "limit": 10,
    "remaining": 0
}