Module 8 5 lessons 69 min
Rate limiting
Someone scripts our login page. It asks for 50,000 OTPs an hour, each one an SMS we pay for, and that night's SMS bill is bigger than the month's server bill.
In this module
4 Read · 1 Lab
- 8.1Why limit requestsBots, buggy apps and one greedy client. Who to limit (user, IP, API key), what to send back (429 and Retry-After), and where the limit lives.Read10 min
- 8.2Counting requestsFixed window and the burst at its edge, sliding window, and token bucket - which lets a real user burst a little.Read14 min
- 8.3One limit across many serversThree servers counting alone allow three times the limit. One counter in Redis, updated in one step so two servers can't both slip through.Read12 min
- 8.4Proof: stop the OTP floodFlood the login from another machine and count the SMS sent: no limit, a limit on each server, then one limit in Redis.Read8 min
- 8.5Lab: Add rate limits to the clinicStop bots grabbing every Monday slot, without blocking patients who book honestly.Lab25 min