Rate Limiting
Rate limiting caps how often a client can act, protecting shared capacity by rejecting or delaying the excess.
Rate limiting restricts how many requests a client can make in a given window, protecting a service's shared capacity from any single caller — malicious or merely enthusiastic — by rejecting or queuing what's over the limit. It's a policy decision as much as a technical one: someone has to decide what "fair" looks like per API key, per IP, or per user, and what happens to the request that exceeds it (usually an HTTP 429 with a Retry-After header).
The two common algorithms behave differently under bursty traffic. A fixed window counter resets every, say, 60 seconds — simple, but it allows a burst of double the limit right at the window boundary, since a client can spend its whole allowance in the last second of one window and the first second of the next. A token bucket instead refills at a steady rate and lets a client spend saved-up tokens in a burst, which is usually the better model for real traffic: it tolerates a legitimate spike while still capping the long-run average.
Rate limiting is enforced at multiple layers for different reasons. An API Gateway rate-limits at the edge to protect everything behind it uniformly, cheaply, before a request even reaches application code. A single service might additionally rate-limit a specific expensive endpoint that the gateway's blanket policy doesn't account for. And a client calling a third-party API has to respect that API's rate limit or get cut off — which is why well-behaved clients implement their own backoff rather than hammering the limit and hoping.
It's a close cousin of Backpressure, but the direction of control is different: rate limiting is a hard cap imposed from outside a client's control, while backpressure is a signal a struggling receiver sends so a well-behaved sender can slow itself down voluntarily.
See also5
Circuit Breaker
A circuit breaker stops calling a failing dependency, converting slow repeated failures into a fast, cheap one.
Networks & Distribution13 connections
Load Balancing
A load balancer spreads requests across many backend instances, turning "one server" into "one address."
Networks & Distribution15 connections
Multi-Factor Authentication
Requiring a second kind of proof besides a password to sign in, such as a code, a phone prompt, or a hardware key, and why only the methods tied to the real website stop modern phishing.
Web Platform11 connections
Middleware
Functions that sit between an incoming web request and the code that answers it, each able to inspect, change, or end the request, chained in an order that quietly determines how the whole application behaves.
Web Platform8 connections
Denial-of-Service Attack
Making a service unavailable by overwhelming it with traffic or expensive requests, usually from many machines at once, and the layered defenses that absorb or filter the flood.
Networks & Distribution12 connections
Linked from16
- API GatewayNetworks & Distribution
An API gateway is the single front door to a set of backend services, handling cross-cutting policy once instead of per-service.
- BackpressureNetworks & Distribution
Backpressure is a slow receiver telling a fast sender to hold up, so a queue grows on purpose instead of by accident.
- Circuit BreakerNetworks & Distribution
A circuit breaker stops calling a failing dependency, converting slow repeated failures into a fast, cheap one.
- Denial-of-Service AttackNetworks & Distribution
Making a service unavailable by overwhelming it with traffic or expensive requests, usually from many machines at once, and the layered defenses that absorb or filter the flood.
- Exponential BackoffNetworks & Distribution
Waiting longer after each failed attempt, with a dose of randomness, so retries give a struggling system room to recover instead of hammering it.
- HTTP Status CodeWeb Platform
The three-digit number at the start of every HTTP response that tells the client, caches, crawlers and monitoring what happened, grouped into five classes by the first digit.
- Key-Value StoreData & Content
The simplest kind of database, which stores opaque values under unique keys and supports little more than get, put and delete, trading query power for speed and easy scaling.
- Load BalancingNetworks & Distribution
A load balancer spreads requests across many backend instances, turning "one server" into "one address."
- MiddlewareWeb Platform
Functions that sit between an incoming web request and the code that answers it, each able to inspect, change, or end the request, chained in an order that quietly determines how the whole application behaves.
- Multi-Factor AuthenticationWeb Platform
Requiring a second kind of proof besides a password to sign in, such as a code, a phone prompt, or a hardware key, and why only the methods tied to the real website stop modern phishing.
- Network Address TranslationNetworks & Distribution
Rewriting the addresses in packets as they cross a router so that many devices can share one public IPv4 address, a stopgap that became permanent and broke the internet's end-to-end design.
- Port ScanningNetworks & Distribution
Probing a machine's network ports to find which services are listening, the first step of both attacks and audits, now done to the entire internet in minutes, so anything exposed gets found.
- Record and ReplayTesting & Verification
Capturing real network responses once and replaying them in later test runs, which makes tests fast and deterministic but lets the recordings drift from the real service.
- Reverse ProxyNetworks & Distribution
A server that sits in front of other servers and receives clients' requests on their behalf, handling encryption, routing, caching, and protection in one place.
- Threat ModelingTesting & Verification
A structured way of asking what could go wrong with a system's security before an attacker answers it, by drawing where data flows, marking where trust changes, and walking each crossing through a list of threats.
- Web CrawlerWeb Platform
A program that discovers the web by fetching pages and following their links, the machinery behind search engines and training datasets, and the voluntary etiquette that governs it.