What is Rate Limiting?
Rate limiting caps the number of requests a client can make within a defined time window, protecting servers from abuse and ensuring fair resource allocation.
Rate limiting is a traffic management mechanism that restricts the number of operations or requests a source (a user, IP address, API key, or session) can initiate within a given time period. It is a core defensive technique against denial-of-service attacks, credential stuffing, web scraping, and any other form of abuse targeting server resources. Rate limits are typically enforced at the application layer, often in a reverse proxy, API gateway, or web application firewall.
When a request arrives, the rate limiter checks a counter for that source, incremented over a sliding or fixed window (for example, 100 requests per minute). If the counter exceeds the configured threshold, the server returns an HTTP 429 (Too Many Requests) status code, optionally with a Retry-After header telling the client how long to wait. More sophisticated implementations use algorithms such as token bucket or leaky bucket to smooth bursts, while others rely on sliding window logs or a generic cell rate algorithm to provide precise accounting. Distributed systems often store counters in a shared cache like Redis to maintain consistency across multiple front-end servers.
Rate limiting sits alongside authentication, IP blacklisting, and CAPTCHA in a defense-in-depth security posture. It differs from throttling, which slows down requests rather than rejecting them outright, and from concurrency limits, which cap the number of simultaneous connections. Rate limits should be documented clearly in API specifications (for example, in an OpenAPI description with the X-RateLimit-* headers) so that clients can respect them proactively. Overly aggressive limits degrade user experience, so limits are often tuned based on traffic patterns and business risk, with higher limits granted to authenticated or premium users.
Key facts
- HTTP status code 429 indicates a rate limit has been exceeded.
- Common algorithms include sliding window, token bucket, and leaky bucket.
- Rate limiting is enforced per IP, API key, user ID, or other unique client identifier.
- Redis is widely used to maintain distributed rate limit counters with minimal latency.
- The Retry-After header tells clients when they may retry a rate-limited request.
How it works in practice
Related terms
References
More in Security
2FA
Two-factor authentication (2FA) is a security method that requires a user to present two distinct types of evidence to verify their identity, typically a password and a time-based one-time code from an authenticator app or hardware key.
Bot Management
Bot management detects automated web traffic and distinguishes it from human users, using behavioral fingerprinting and other signals to block malicious bots while allowing benign ones.
Credential Stuffing
Credential stuffing is a cyberattack in which automated tools use username-password pairs leaked from one site to try logging into other sites, exploiting password reuse.
DDoS
A DDoS (Distributed Denial of Service) attack overwhelms a target server, service, or network with massive traffic from many compromised computers, making it unavailable to legitimate users.
DDoS Scrubbing
DDoS scrubbing diverts attack traffic to a specialized filtering facility that removes malicious packets and forwards only legitimate traffic to the target network.
Firewall
A network security device or software that monitors and controls incoming and outgoing traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.
IDS
An Intrusion Detection System (IDS) monitors network traffic or host activity for signs of malicious behavior or policy violations and generates alerts for security personnel.
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic inline and actively blocks malicious packets before they reach their target.
OAuth 2.0
OAuth 2.0 is an authorization framework that allows a user to grant a third-party application limited access to their resources on another service without revealing their password.
OpenID Connect
OpenID Connect (OIDC) is an identity authentication layer built on OAuth 2.0 that provides a signed ID token containing verified user identity claims.