Loading...
Loading...
Master algorithm selection, Redis distributed implementations, and API gateway protection patterns.
Rate limiting prevents Denial of Service (DoS), stops credential stuffing, protects downstream services from cascading failure, and controls cloud infrastructure costs.
Without rate limiters, a single misconfigured client or malicious DDoS attack can exhaust database connection pools or API server memory. Rate limiters act as shield walls at the perimeter.
Fixed Window Counter, Sliding Window Log, Sliding Window Counter, Token Bucket, and Leaky Bucket.
Token Bucket is best for handling bursts; Leaky Bucket is best for smoothing output queues; Sliding Window Counter provides high accuracy with low memory overhead.
In a multi-region microservices cluster, rate limit counters must be synchronized via Redis Lua scripts or local memory with periodic sync.
Executing Lua scripts inside Redis guarantees atomic execution of read-increment-expire operations without race conditions under concurrency.
Top FAANG and tier-1 system design interview questions.
How do you handle rate limiting for 100 Million daily active users?
Use Redis clusters sharded by user_id or IP address using Sliding Window Counters implemented via Redis Lua scripts, backed by local in-memory caches (L1 cache) with 1-second sync to reduce Redis network round-trips.
What HTTP status code and headers should a rate-limited response return?
Return HTTP Status 429 (Too Many Requests), along with headers: X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After.