Information given here adequately explains the "Stateless" nature of REST. Even going as far as to say:
For becoming stateless, do not store even authentication/authorization details of client. Provide credentials with the request. Each request MUST stand alone and should not be affected by the previous conversation happened from the same client in past.
With this being said, does rate-limiting violate the statelessness of REST? Or in short, is rate-limiting RESTless?
I'm currently implementing rate-limiting for an API. I'm using a pseudo-sliding window approach. I split time into set intervals (viz. 1 minute) and record how many requests occurred in the last interval and the current interval. I then take a weighted average of the last interval and the current interval based on how far into the current interval I am. This works well.
To make this stateless, I thought of sending the previous interval request count and current interval request count in the JWT for authentication. However, if the user were to request a new token, these would be reset.
Is there any way to truly make rate-limiting stateless? Or does this even violate REST's stateless approach?