Rate Limiting Reference
Reference 为速率 limiting algorithms, strategies, 和 distributed implementations.
Algorithms
Fixed window counting limits per time window but allows bursts at boundaries. Sliding window log tracks timestamps for precise limits but uses more memory. Token bucket allows bursts up to bucket capacity with steady refill rate. Leaky bucket smooths output rate with a queue. Sliding window counter approximates sliding window with less memory using two fixed windows. Each algorithm has tradeoffs in precision, memory, and burst tolerance.
- fixed window
- Simple, bursty edges
- token bucket
- Bursts allowed
- sliding window
- Precise, more memory
count per windowcapacity + refilltimestamp logDistributed Implementation
Distributed rate limiting requires shared state, typically Redis or a dedicated service. Redis INCR with TTL implements fixed window; sorted sets implement sliding window. Race conditions require atomic operations (Lua scripts in Redis). The token bucket can be distributed with careful counter management. Client-side limiting provides defense in depth but is bypassable. Identify clients by IP, API key, user ID, or fingerprint. Return 429 Too Many Requests with Retry-After header.
- Redis
- Shared counter
- atomic
- Lua scripts
- 429
- Too Many Requests
INCR + TTLprevent racesRetry-After header