Implementing Rate Limiting
1. Using Token Bucket Algorithm
| Property | Value |
|---|
| Capacity | Max tokens (burst size) |
| Refill rate | Tokens added per second |
| Behavior | Each request consumes 1 token; reject if empty |
| Pros | Allows bursts, smooth average |
2. Using Fixed Window Algorithm
| Property | Value |
|---|
| Window | Fixed time slot (e.g. each minute) |
| Counter | Resets at window boundary |
| Pros | Simple, low memory |
| Cons | Boundary burst (2x limit at window edge) |
3. Using Sliding Window Algorithm
| Variant | How |
|---|
| Sliding log | Store timestamps; count in last N sec; accurate, memory-heavy |
| Sliding counter | Weighted blend of current+previous fixed windows; approximate, low memory |
4. Implementing Per-User Rate Limits
| Key | Notes |
|---|
| userId / API key | Authenticated requests |
| IP address | Anonymous; account for NAT/proxies |
| userId + endpoint | Per-endpoint quotas |
5. Implementing Per-IP Rate Limits
Warning: X-Forwarded-For can be spoofed. Trust only from your load balancer; use the client's connecting IP at edge.
| Use Case | Limit |
|---|
| Login endpoint | 5-10 / minute / IP |
| Public read | 60-100 / minute / IP |
| Anonymous abuse | Stricter; combine with CAPTCHA |
| Header | Value |
|---|
X-RateLimit-Limit | Total per window |
X-RateLimit-Remaining | Remaining count |
X-RateLimit-Reset | Unix epoch when reset |
RateLimit NEW (RFC 9239) | limit=100, remaining=42, reset=30 |
7. Returning 429 Status Code
Example: Rate Limit Exceeded
HTTP/1.1 429 Too Many Requests
Content-Type: application/problem+json
Retry-After: 60
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1747304460
{
"type": "https://example.com/errors/rate-limit",
"title": "Rate Limit Exceeded",
"status": 429,
"detail": "100 requests/minute exceeded; retry in 60s"
}
| Format | Example |
|---|
| Seconds (delta) | Retry-After: 120 |
| HTTP date | Retry-After: Sat, 15 May 2026 10:30:00 GMT |
| When to send | 429, 503, 3xx redirects |
| On Every Response | Why |
|---|
X-RateLimit-Remaining | Clients pace themselves preemptively |
X-RateLimit-Reset | Predictable backoff |
| Documentation | Limits per tier published |
10. Implementing Tiered Rate Limits
| Tier | Limit |
|---|
| Anonymous | 60 / hour |
| Free | 5,000 / hour |
| Pro | 50,000 / hour |
| Enterprise | Custom (SLA-based) |
11. Handling Burst Traffic
| Technique | Effect |
|---|
| Token bucket with high capacity | Permit short bursts |
| Leaky bucket | Smooth output; queue excess |
| Backpressure (429 + Retry-After) | Push load back to client |
| Auto-scale workers | Absorb sustained surges |