Is it safe to use guava's ratelimiter on my company's login page?

Question

I noticed Guava's RateLimiter has the @Beta annotation, so intelliJ gives a warning saying it is unstable.

I would like to use it like this in my companie's login page to ratelimit incoming requests.

RateLimiter throttle = new RateLimitter.create(1.0);


public void doLogin(HttpServletRequest request, HttpServletResp0onse response){
    throttle.acquire(); //or throttle.tryAcquire();
    //do the rest of the login


}

Will this work as intended? Or should I stay away from incorprating this into such a big functionality of my company because of the @Beta tag?

Answer 1

The @Beta annotation is documented as:

Signifies that a public API (public class, method or field) is subject to incompatible changes, or even removal, in a future release. An API bearing this annotation is exempt from any compatibility guarantees made by its containing library. Note that the presence of this annotation implies nothing about the quality or performance of the API in question, only the fact that it is not "API-frozen."

It is generally safe for applications to depend on beta APIs, at the cost of some extra work during upgrades. However it is generally inadvisable for libraries (which get included on users' CLASSPATHs, outside the library developers' control) to do so.

This means that if you upgrade to a newer version of Guava, you may need to port your changes over to match a new API definition. However, there's no implication about the quality, performance, or reliability of this API.

However, the use of this RateLimiter in a logic page isn't really that good of an idea. consider whether a rate limit of 1 QPS per server is suitable for your login page. Your users and employees may encounter unavailability if multiple logins are attempted at the same time, and if you use acquire instead of tryAcquire you will block your handler threads. You should consider why you are interested in rate-limiting global accesses to this function and adapt accordingly.