EMZETT.
Login

Emzett Wiki

Rate limiting: limiting requests and slowing abuse

Properties1
tagsglossar, backend, sicherheit

2 min read

Rate limiting: limiting requests and slowing abuse

In short: Rate limiting restricts how often a client may call an interface within a period; it protects against overload, brute force and scraping and is answered with HTTP 429.

In more detail: Without limits a single client (or bot) can burden server, database and bill. Typical targets: login (password guessing), registration/password reset (mail spam), expensive endpoints (search, AI), scraping, fair use of a public API.

In Depth

Algorithms

  • Fixed window: max. 100 requests per minute; simple, but peaks at the window boundary (up to 2× in quick succession).
  • Sliding window: more accurate, somewhat more complex.
  • Token bucket: bucket fills at rate r, each request costs a token; allows short bursts up to bucket size.
  • Leaky bucket: smooths to a constant outflow rate.
  • Concurrency limit: max. N parallel requests per user.

Who is counted?

Choose a key: IP address (caution: NAT/school networks share an IP; behind proxies read the real IP from X-Forwarded-For only from trusted proxies), user account, API key, combination (e.g. account + IP at login). Stricter for anonymous, more generous for signed-in/paying users. Login protection: additionally limit per username, increasing delays, captcha, lockout with notification.

Implementation

  • Counters in Redis (INCR + EXPIRE) or libraries (Upstash Ratelimit, express-rate-limit, Nginx limit_req, Cloudflare/WAF rules).
  • Serverless/multiple instances: counters not in process memory but central (Redis, database).
  • Answer HTTP 429 Too Many Requests with Retry-After and optionally RateLimit-Limit/Remaining/Reset headers.
  • Clients should retry with exponential backoff + jitter.
  • Additionally timeouts, size limits, pagination and quotas (per day/month).

Limits and practice

Rate limiting alone does not stop distributed attacks (DDoS): for that CDN/WAF, bot detection, upstream protection. Also do not lock out legitimate users: derive limits from real measurements, error message understandable, logging/alarm on persistent exceedance. Test the limits, document limits in the API docs. Privacy: IP addresses are personal data, store them briefly.

See also: Debounce and throttle

Backlinks