DEFINITION -> Rate limiting is a backend technique used to control the number of requests a client can make within a specific time period -> It protects systems from abuse, overload, and malicious attacks -> Ensures fair usage of resources across users
WHY RATE LIMITING IS IMPORTANT
-> Prevents brute-force attacks -> Protects APIs from abuse and spam -> Avoids server overload and downtime -> Ensures fair access for all users -> Helps maintain system stability
HOW RATE LIMITING WORKS
-> Client sends requests to the server -> Server tracks number of requests per client -> If requests exceed defined limit -> Server blocks or delays further requests -> Client receives error response (e.g., 429 Too Many Requests)
COMMON RATE LIMITING STRATEGIES
FIXED WINDOW -> Limits requests within a fixed time window -> Example: 100 requests per minute -> Simple but can cause bursts at window boundaries
SLIDING WINDOW -> Tracks requests over a rolling time window -> More accurate and smooth control -> Reduces sudden spikes
TOKEN BUCKET -> Tokens are added at a fixed rate -> Each request consumes a token -> Allows controlled bursts while maintaining limits
LEAKY BUCKET -> Requests are processed at a constant rate -> Excess requests are queued or dropped -> Ensures steady traffic flow
IDENTIFYING CLIENTS
-> IP address -> API key -> User ID -> Session or token
IMPLEMENTATION APPROACH
-> Define request limits per time window -> Choose rate limiting strategy -> Store request counts in fast storage (e.g., Redis) -> Track timestamps for each request -> Enforce limits before processing requests
RESPONSE HANDLING
-> Return HTTP 429 status when limit is exceeded -> Include retry-after header -> Provide meaningful error messages -> Optionally throttle instead of blocking
DISTRIBUTED SYSTEM CONSIDERATIONS
-> Use centralized storage like Redis for consistency -> Synchronize counters across multiple servers -> Avoid race conditions with atomic operations -> Use API gateways for global rate limiting
BEST PRACTICES
-> Set different limits for different endpoints -> Apply stricter limits on sensitive operations (e.g., login) -> Combine with authentication for better control -> Monitor and adjust limits based on traffic -> Log rate-limited requests for analysis
COMMON USE CASES
-> Login attempt limiting -> Public API usage control -> Preventing scraping and bots -> Protecting payment endpoints
TOOLS AND TECHNOLOGIES
-> Redis for fast counters and caching -> API gateways (e.g., Nginx, Kong) -> Backend frameworks with middleware support -> Cloud services with built-in rate limiting
CHALLENGES
-> Handling distributed environments -> Avoiding false positives for legitimate users -> Balancing strictness and user experience -> Scaling with high traffic systems
BACKEND ENGINEERING HANDBOOK
->Grab the Backend Engineering Handbook -> codewithdhanian.gumroad.com/l/ungqng