Rate Limiting
Rate-Limiting is a fundamental technique in Computer-Networking and Software-Architecture designed to control the rate of requests sent to a server or service. This mechanism is vital for maintaining the Availability and Reliability of web services by preventing resource exhaustion. It serves as a primary defense against Denial-of-Service (DoS) attacks and Brute-Force-Attacks, ensuring that API resources are shared fairly among all legitimate users.
Several Algorithms are commonly used to enforce these limits. The Token-Bucket algorithm allows for short bursts of traffic while maintaining an average rate, whereas the Leaky-Bucket algorithm enforces a strict, constant output rate. Other approaches include Fixed-Window-Counter and Sliding-Window-Log, which offer varying degrees of precision and memory efficiency. Modern infrastructure components like NGINX, HAProxy, and Redis provide robust built-in support for implementing these policies. Distributed systems often rely on Redis to synchronize request counts across multiple application nodes.
Major Content-Delivery-Network providers such as Cloudflare and Akamai offer global Edge-Computing solutions to mitigate malicious traffic before it reaches the origin server. For further technical specifications, the RFC 6585 standard defines the 429 Too Many Requests HTTP status code used to signal rate limit violations. Additional implementation strategies are documented by NGINX and MDN Web Docs.