You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 9cdd24d
Browse filesBrowse the repository at this point in the historyBrowse files
Copy file name to clipboardExpand all lines: src/content/articles/rate-limiting-token-bucket-leaky-bucket-implementation/index.mdx
+20-12Lines changed: 20 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,15 +18,16 @@ I watched this play out at a company that implemented per-IP rate limiting at 10
18
18
19
19
The fix? They combined __sliding window counter__ (to eliminate the boundary problem) with __token bucket__ for burst control. Same traffic spike: requests distributed smoothly, everyone got served, the backend hummed along at capacity without falling over.
20
20
21
-
The naive approach—"block anything over N requests"—fails because it treats rate limiting as a wall instead of a valve. The algorithms matter, but __where__ you limit and __how__ you identify clients matter more.
21
+
The naive approach — _"block anything over N requests"_ — fails because it treats rate limiting as a wall instead of a valve. The algorithms matter, but _where_ you limit and _how_ you identify clients matter more.
22
22
23
23
## Where to Rate Limit
24
24
25
25
Most rate limiting articles jump straight to algorithms. But the strategic question — where in your stack to enforce limits — often matters more than which algorithm you choose.
Here's how traffic patterns play out with a 10-token bucket refilling at 1 token per second:
105
105
106
106
<Table
107
-
variant="vertical-column-delineation-table"
107
+
variant="grid-and-accent-header-table"
108
+
fullWidth={false}
108
109
content={{
109
110
thead: {
110
111
th: ['Traffic Pattern', 'What Happens'],
@@ -142,7 +143,7 @@ For distributed systems, you need atomic operations. The standard pattern is a R
142
143
The rate limiting key — how you identify who's making requests — is as important as the algorithm. Choose wrong, and you'll either punish legitimate users or fail to stop abuse.
143
144
144
145
<List
145
-
variant="check-icons-list"
146
+
variant="zebra-list"
146
147
items={[
147
148
{
148
149
lead: 'IP address',
@@ -156,7 +157,11 @@ Header spoofing is trivial: `curl -H "X-Forwarded-For: 1.2.3.4" your-api.com`. I
0 commit comments