Flowable (V6) VS bucket4j

I’m doing a lot of exploratory work with BPMN right now.

I think if your business is largely transactional (think Stripe), there is a lot of value to be had by framing your development as “business process automation”.

The term (and BPMN) has a lot of enterprise baggage, but some of the tools out there [0][1] are well suited to orchestrating services (and people where necessary) as a single automated process. The the ability to build that flow visually using BPMN, and then execute it in a workflow engine where you can monitor it, audit it, and optimize over time is pretty compelling.

Here’s an interesting read on the topic: https://www.infoq.com/articles/events-workflow-automation/

[0] https://github.com/camunda-cloud/zeebe

[1] https://github.com/flowable/flowable-engine

-- Bucket4J

See https://github.com/vladimir-bukhtoyarov/bucket4j and https://github.com/cowwoc/token-bucket for alternatives.

Hi everyone! My name is Maxim Bartkov, I'm a co-author of Bucket4J library. I want to present the library to provide rate-limiting in Java. Bucket4J - this is the most popular library to provide rate-limiting in Java. I invite each person to familiarize themselves with Bucket4J. We have been working for more than 7 years for the community and we want to make the library and open-source better. Bucket4J is used in many other libraries, such: Kubernetes client, JHipster, Atlassian, Twitch4J, and other popular libraries. Now we are going to huge release 7.0 with many features, we will publish about that a little bit later (in a few weeks). I hope on your support, we will be glad to your any contribution/suggestions/ideas.

Implemented rate-limiting on REST-APIs by creating a custom spring security filter and adding it to the filter-chain. Bucket4j library is used to manage and handle the users configured quota to consume services per hour using token-bucket algorithm. The quota of the user is based upon the type of plan selected during account-creation.

However, if you're serving a public resource, authorization isn't going to help restrict requests. If you're concerned about Denial of Service attacks, and aren't relying on infrastructure upstream of you to manage those, you'd focus your mitigations in Step 2. For example, you could use something like https://github.com/vladimir-bukhtoyarov/bucket4j to create rate-limited buckets on IP addresses or ranges.