We'd like to implement API rate limiting for Grails 3 application. We use interceptor and redis for this purpose. There is however a problem of opening hibernate session (which opens database connection) for each request coming to Grails. This is a resource consumption we cannot neglect as it can easily reach MySQL connection limits with simple attack.
The question is what is the best way how to force Grails not to open hibernate session for certain urls/interceptors. I am aware of API gateways like konghq.com which is not an option for us.
I also know about
OpenSessionInViewInterceptor which is responsible for session management. So is it the only one option to override this interceptor? How would you open hibernate sessions for those request complying with rate limits?