Art of Codeartofcode
Lesson 13 of 14

25. Rate Limiting

1
The picture to keep in your head
2
25.1 Why limit?
3
25.2 What are the algorithms?
4
25.3 How do the algorithms compare?
5
25.4 How does distributed rate limiting with Redis work?
6
25.5 Where should the limiter go?
7
25.6 What do 429 and rate-limit headers look like?
8
25.7 How do you handle bots and abuse?
9
Memory card and where the analogy breaks
10
Practice: five levels
11
Interview questions
12
Solutions
13
Sources
14
Code lab
25. Rate Limiting

Sources

3 min read+10 XP

Source notes

  • 429 Too Many Requests: IETF RFC 6585, 2012. Retry-After: IETF RFC 9110. RateLimit header fields: IETF HTTPAPI working group draft.
  • NGINX limit_req uses the leaky bucket method: NGINX documentation, ngx_http_limit_req_module, checked 2026-10-08.
  • Sliding window counter accuracy (0.003% of requests wrongly allowed or rate limited, in an analysis of 400 million requests from 270,000 sources): Cloudflare blog, "How we built rate limiting capable of scaling to millions of domains" (2017), checked 2026-10-08.
  • GitHub REST API limits (5,000 requests an hour for authenticated users, 60 for unauthenticated) and x-ratelimit-* headers: GitHub Docs, "Rate limits for the REST API", checked 2026-10-08.
  • Token bucket rate limiters in production: Stripe engineering blog, "Scaling your API with rate limiters" (2017).
  • Redis INCR, EXPIRE, sorted sets and Lua scripting: Redis documentation.
  • Plan limits, traffic volumes and attack sizes are illustrative assumptions; arithmetic computed 2026-10-08.
  • Level 3 and Level 4 code: tested 2026-10-08 (code/ch25_rate_limiting.py, all checks pass).