actix-governor

actix-governor is a middleware for the actix-web framework that adds rate limiting to your HTTP services. It is backed by the governor crate, which implements the GCRA (generic cell rate) algorithm for accurate, high-throughput request throttling.

With a fluent configuration builder you set the replenishment rate and burst size, then wrap your app or specific scopes with the Governor middleware. It supports per-IP keying by default, custom key extractors, and configurable responses when limits are exceeded.

What You Get

• A Governor actix-web middleware you attach with .wrap()
• A GovernorConfigBuilder for setting replenishment rate and burst size
• Per-IP rate limiting by default, with custom key extractors
• Configurable behavior and responses when a client is rate limited
• High-performance GCRA throttling via the governor crate

Common Use Cases

• Throttling public API endpoints to prevent abuse
• Protecting login or signup routes against brute-force attempts
• Applying different rate limits to specific route scopes
• Keeping a service stable under bursty traffic

Under The Hood

Architecture

The crate wraps governor’s RateLimiter in an actix-web Transform/Service middleware. A GovernorConfig, built by GovernorConfigBuilder, holds the quota (replenishment interval and burst size) plus a KeyExtractor that derives the throttling key from each request (peer IP address by default). On each request the middleware looks up or creates the limiter cell for that key, checks the GCRA quota, and either forwards the request or short-circuits with a configurable 429-style response including retry headers. Custom key extractors and error handlers let you tailor keying and rejection behavior.

Tech Stack

Pure Rust built on actix-web’s middleware system and the governor crate for the underlying GCRA rate limiter. It targets async actix-web servers and ships as the actix-governor crate on crates.io, with docs on docs.rs and CI via GitHub Actions.

Code Quality

The codebase is compact and focused (single-crate, ~90KB of Rust) with the middleware, config builder, and key-extractor abstractions cleanly separated. It carries a test suite and CI, an example in the README, and a stable, well-documented public API refined over several major releases since 2020.

API Design

The developer experience is deliberately simple: build a config, wrap the app, done. The builder pattern makes quota configuration readable, and the KeyExtractor trait provides an escape hatch for advanced keying (API keys, user IDs) without complicating the common IP-based case. Documentation and a runnable example keep onboarding quick.