Why Rate Limit APIs?
Rate limiting protects APIs from abuse, denial-of-service (DoS) attacks, brute-force requests, and programming loops that flood the database with requests.
Rate Limiting Algorithms
- Token Bucket: A bucket contains a fixed number of tokens. Each request consumes a token. Tokens refill at a steady rate. If the bucket is empty, requests are rejected.
- Sliding Window: Records request timestamps in a sorted set (e.g., using Redis) and counts requests within the immediate past window.
HTTP Status 429
When limits are exceeded, servers respond with status code 429 (Too Many Requests), adding "Retry-After" headers to specify when the client can try again.