coding · Any · free
Design rate limiting for this endpoint / product. Endpoint(s): [PATH + METHOD] Legit user behavior: [P50 REQ/MIN, P99, PEAK] Abuse we've seen: [SCRAPERS / CREDENTIAL STUFFING / SIGNUP BOTS / NONE YET] Multi tenant? [Y/N] Budget for infra: [REDIS AVAILABLE / EDGE ONLY / DB ONLY] Deliver: 1. Algorithm choice — fixed window / sliding window / token bucket / leaky bucket — and why for THIS traffic shape 2. Key strategy — IP alone is broken behind CGNAT / mobile; propose the composite key (userId + IP + route class) 3. Limits table — per route class, per tier, per key, in a copy pasteable format 4. Response contract — 429 with Retry After, X RateLimit headers, JSON body shape 5. Storage — Redis Lua script vs Cloudflare / edge KV — pick one with code 6. Bypass paths — health checks, internal callers, allow list mechanism 7. Failure mode — fail open vs fail closed if the limiter itself dies 8. How to A/B tighten limits without paging on call at 3am
#rate-limiting #security #backend