Skip to content

Rate Limiting / Throttling

Specifically: denial of service attacks, overloading the system, attackers attempting to crack passwords

You can throttle (or rate-limit) by username, IP address, region, or even across the whole system, e.g. 10 RPS globally.

You can store rate-limiting info, e.g. the number of times a particular user has accessed a feature, in an in-memory database like Redis.

Rate-limiting can be done in a complex way: allow a user to access a service 0.5 s between requests but only 3x every 10 and only 10x in a single minute.

The response code for "too many requests" is 429.

Rate limiting is one aspect of throttling. The other is throughput limiting. For instance, your internet bandwidth FUP plans. Or your netflix subscription plans offering different video resolutions for different subscription fees