Rate limiter
Caps how many requests a client can make in a period of time.
Main article: Rate limiter simulator
Origin
Rate limiting began in packet networks: Jonathan Turner described the leaky bucket in 1986, and token buckets were used to describe traffic in IP quality-of-service standards in the 1990s. HTTP gained a status code for it, 429 Too Many Requests, in RFC 6585 (2012).
Where it shows up in production
- Stripe API A token bucket per user kept in Redis, plus a concurrency limit and load shedders, as described on its engineering blog in 2017.
- GitHub REST API 5,000 requests per hour for an authenticated user, reported in x-ratelimit headers on every response.
- Cloudflare rate limiting Per-IP / per-URL / per-cookie rules at the edge.
On Semicolony
Sources & further reading
Found this useful?