Rate Limiting is one of the most common API security mechanisms used to prevent abuse, brute-force attacks, DDoS attacks, and resource exhaustion. It controls how many requests a client can make within a specific time period.

---

Q1. What is Rate Limiting?

Answer

Rate Limiting restricts the number of requests a client can make to an API during a defined time window.

Example

100 Requests / Minute

If a client sends more than 100 requests within one minute, the server rejects additional requests.

Benefits

• Prevents API abuse
• Protects backend services
• Prevents brute-force attacks
• Improves system stability
• Ensures fair resource usage

---

Q2. Why is Rate Limiting important?

Answer

Without rate limiting, attackers can:

• Flood APIs
• Launch DDoS attacks
• Perform brute-force login attempts
• Consume server resources
• Increase infrastructure costs

Production Example

Imagine an OTP API:

POST /send-otp

Without rate limiting, an attacker can generate millions of OTP requests and overload the SMS service.

---

Q3. What HTTP status code is returned when the rate limit is exceeded?

Answer

The server returns:

HTTP/1.1 429 Too Many Requests

Example response:

{
  "message": "Rate limit exceeded. Please try again later."
}

Many APIs also include response headers:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
Retry-After: 60

---

Q4. What are the common Rate Limiting algorithms?

Answer

The most popular algorithms are:

• Fixed Window Counter
• Sliding Window Log
• Sliding Window Counter
• Token Bucket
• Leaky Bucket

Comparison

Algorithm	Best For
Fixed Window	Simple applications
Sliding Window	Better accuracy
Token Bucket	APIs with traffic bursts
Leaky Bucket	Constant traffic flow
Sliding Counter	Distributed systems

---

Q5. What is the Token Bucket algorithm?

Answer

The Token Bucket algorithm stores tokens in a bucket.

• Each request consumes one token.
• Tokens are replenished at a fixed rate.
• If no tokens remain, requests are rejected.

Example

Bucket Size:

100 Tokens

Refill Rate:

10 Tokens / Second

This allows temporary traffic bursts while maintaining an average request rate.

Use Cases

• Public APIs
• Payment APIs
• Mobile applications

---

Q6. How is Rate Limiting implemented in Microservices?

Answer

Rate limiting is typically implemented at the API Gateway rather than inside each microservice.

Architecture:

Client
   │
API Gateway
   │
Redis Counter
   │
Spring Boot Services

The gateway checks the request count before forwarding traffic to backend services.

Benefits

• Centralized policy management
• Reduced duplication
• Better scalability
• Consistent enforcement

---

Q7. Why is Redis commonly used for Rate Limiting?

Answer

Redis is widely used because it provides:

• Extremely fast in-memory operations
• Atomic increment commands
• Automatic key expiration (TTL)
• Distributed access across multiple instances

Example:

User:123

Requests = 87

Expires = 60 seconds

Redis enables rate limiting to work correctly even when APIs run on multiple servers.

---

Q8. What are common Rate Limiting strategies?

Answer

Rate limiting can be applied based on:

• IP Address
• User ID
• API Key
• OAuth Client
• JWT Subject
• Organization
• Geographic Region

Example

User Type	Limit
Anonymous	50/min
Registered User	500/min
Premium User	5000/min
Internal Service	Unlimited

---

Q9. What is the difference between Rate Limiting and Throttling?

Answer

Rate Limiting	Throttling
Restricts request count	Slows request processing
Rejects excess requests	Delays requests
Returns HTTP 429	Introduces wait time
Protects APIs	Controls traffic flow

Example

Rate Limiting

101st request

↓

Rejected

Throttling

101st request

↓

Delayed

---

Q10. What are the Rate Limiting best practices?

Answer

Follow these best practices:

• Implement rate limiting at the API Gateway.
• Store counters in Redis.
• Return HTTP 429 when limits are exceeded.
• Include Retry-After headers.
• Apply different limits for different user tiers.
• Monitor rejected requests.
• Protect login and OTP APIs with stricter limits.
• Combine rate limiting with WAF and DDoS protection.
• Use token bucket for burst traffic.
• Continuously tune limits based on production metrics.

Production Security Architecture

                 Internet
                     │
               Load Balancer
                     │
               Web Application Firewall
                     │
                API Gateway
                     │
              Rate Limiter (Redis)
                     │
         JWT Authentication Filter
                     │
            Spring Boot Microservices
                     │
                 Database

Senior Interview Tip

Rate Limiting alone is not sufficient for API security. In enterprise systems it should be combined with:

• Authentication
• Authorization
• WAF
• API Gateway
• HTTPS
• JWT/OAuth2
• Monitoring
• Logging
• DDoS Protection

This layered approach provides stronger protection against abuse and malicious traffic.

---

Quick Revision

• Rate Limiting restricts API requests within a time window.
• HTTP 429 indicates the client exceeded the limit.
• Redis is commonly used for distributed rate limiting.
• Token Bucket is ideal for burst traffic.
• API Gateway is the preferred place to enforce rate limits.
• Apply different limits for different users.
• Monitor rejected requests.
• Protect login and OTP APIs with stricter limits.
• Include Retry-After headers.
• Combine rate limiting with other security mechanisms.