Rate Limiting

What is Rate Limiting?

Rate limiting is a technique used to control the number of requests a user, client, or system can make to a resource—such as an API, website, or service—within a specified period of time. By enforcing these limits, you can prevent abuse, protect your infrastructure from overload, and ensure a fair experience for all users. Rate limiting is a fundamental part of API design, web security, and scalable system architecture.

Why is Rate Limiting Important?

• Prevents Abuse & Attacks: Stops malicious actors or bots from overwhelming your service with excessive requests (e.g., brute-force, scraping, or denial-of-service attacks).
• Protects Resources: Shields your backend, databases, and third-party services from being overloaded, which can lead to downtime or increased costs.
• Ensures Fairness: Guarantees that all users have equitable access to your service, preventing a single user from monopolizing resources.
• Improves Reliability: Helps maintain consistent performance and availability, even under heavy load or unexpected traffic spikes.

Common Algorithms

• Fixed Window: Simple counter per window (e.g., 100 requests/minute)
• Sliding Window: Tracks requests in a rolling window for smoother limiting
• Token Bucket: Allows bursts; tokens refill at a set rate
• Leaky Bucket: Processes requests at a steady rate; excess is dropped or queued

Rate Limiting Examples: Flask (limits) vs Django

# Flask + limits (with Redis)
from flask import Flask, request, jsonify
from limits import parse
from limits.storage import RedisStorage
from limits.strategies import FixedWindowRateLimiter

app = Flask(__name__)
storage = RedisStorage("redis://localhost:6379")
limiter = FixedWindowRateLimiter(storage)
rate_limit = parse("5/minute")  # 5 requests per minute

@app.route('/api')
def my_api():
    client_ip = request.remote_addr
    if not limiter.hit(rate_limit, client_ip):
        return jsonify({'error': 'Rate limit exceeded.'}), 429
    return jsonify({'message': 'Request successful!'})

if __name__ == '__main__':
    app.run(debug=True)
    

# Django rate limiting using django-ratelimit
# pip install django-ratelimit
from django.http import JsonResponse
from django.views.decorators.http import require_GET
from ratelimit.decorators import ratelimit

@require_GET
@ratelimit(key='ip', rate='5/m', block=True)
def my_api(request):
    return JsonResponse({'message': 'Request successful!'})

# For class-based views:
from django.utils.decorators import method_decorator
from django.views import View

@method_decorator(ratelimit(key='ip', rate='5/m', block=True), name='dispatch')
class MyApiView(View):
    def get(self, request):
        return JsonResponse({'message': 'Request successful!'})
    

Best Practices

• Return HTTP 429 for rate limit violations
• Inform users of their limit status (headers or body)
• Use Redis or similar for distributed setups
• Use libraries like Flask-Limiter, limits, or django-ratelimit

Summary Table

Method	Allows Bursts	Smooth	Memory Usage	Complexity	Use Case
Fixed Window	No	No	Low	Low	Simple APIs
Sliding Window Log	No	Yes	High	Medium	High-accuracy APIs
Sliding Window Counter	No	Yes	Medium	Medium	Smoother limits
Token Bucket	Yes	Yes	Low	Medium	Most APIs
Leaky Bucket	No	Yes	Low	Medium	Steady flow needed
Concurrent Limiting	N/A	N/A	Low	Low	Resource protection
Dynamic/Adaptive	Varies	Varies	Varies	High	Large-scale platforms

References:

• limits (Python rate limiting library)
• Flask-Limiter
• django-ratelimit