Algorithms
- Fixed window — N requests per fixed interval (e.g. 100 per minute). Simple, but vulnerable to burst attacks at window boundaries
- Sliding window — a rolling window, more even distribution
- Token bucket — the client receives tokens at a fixed rate and spends one per request; allows short bursts
- Leaky bucket — requests are processed at a uniform rate, regardless of bursts
Implementation
Store counters in Redis — it supports atomic increment and TTL. The HTTP response when a limit is exceeded: 429 Too Many Requests with a Retry-After header.