Rate Limiting
Capping how many requests a client may make, protecting a service from overload and abuse.
Rate limiting enforces a request ceiling per client. The token bucket is the common algorithm: a bucket of capacity tokens refills at a steady rate; each request spends one, and an empty bucket rejects — capacity sets the burst, refill rate the sustained limit.
Worked example: a bucket of capacity 10 refilling 1 token/second lets a client fire 10 requests instantly (the burst), then settle to 1/second (the sustained rate) — so bursty clients are tolerated but sustained abuse is capped. Gotcha: the algorithm choice matters. A naive fixed-window counter (100/minute) lets a client send 100 at 0:59 and 100 at 1:00 — 200 in two seconds, double the intended rate, at the boundary. Token bucket and sliding-window log avoid that; reach for them when the limit must actually hold.