Rate limiting

Rate limiting is a technique for controlling how many requests a single client — an IP address, a user or an API key — can send to a server within a defined time window. Once the threshold is crossed, further requests are rejected (usually with HTTP status 429 Too Many Requests) or delayed. The mechanism protects infrastructure from overload, abuse and certain kinds of attack.

How rate limiting works

A limit is defined as a number of requests per unit of time, e.g. "100 requests per minute per IP". Several classic algorithms enforce it:

• Token bucket — tokens drip into a "bucket" at a fixed rate; each request consumes one, and when the bucket is empty the request is rejected. This allows short bursts of traffic.
• Leaky bucket — requests drain out at a constant rate, smoothing traffic.
• Fixed window / sliding window — counting requests within a fixed or sliding time boundary.

Rate limiting can be applied at several levels: in the application layer (e.g. framework middleware), on a proxy or web server (Nginx), in an API gateway, or in an application firewall.

Rate limiting in practice

Request-rate limiting is a standard way to protect network services:

1. API protection — an API imposes per-key limits to ensure fair access and guard against resource abuse.
2. Attack defense — limits hinder brute force against login forms and blunt some DDoS attacks.
3. Server stability — capping requests per endpoint prevents aggressive bots and scrapers from exhausting resources.

Well-designed rate limiting distinguishes authenticated traffic from anonymous and returns clear headers with the remaining quota, so clients can adjust how often they call.