API Rate Limiting: Throttling, Quota and DDoS Protection

What is Rate Limiting?

Rate limiting is limiting the number of requests that can be made in a specific time period (second, minute, hour).

Purposes: Prevent API abuse, ensure fair usage, protect server resources, reduce DDoS attacks.

When rate limit exceeded: Returns 429 (Too Many Requests) HTTP status code. Specifies when to retry with Retry-After header.

Rate limiting increases API availability and reliability. Ensures SLA (Service Level Agreement) compliance.

Rate Limiting Algorithms

Fixed Window: Counter kept in fixed time window (e.g., 100 requests per minute). Simple but boundary problem (spike at window boundaries).

Sliding Window Log: Store timestamp of each request. Count requests in last N seconds. More accurate but uses more memory.

Sliding Window Counter: Hybrid of fixed window and sliding window log. Less memory, more accurate result.

Token Bucket: Tokens produced at specific rate. Each request consumes one token. Provides burst support.

Leaky Bucket: Requests added to queue and processed at fixed rate. Provides traffic smoothing.

Rate Limiting Strategies

IP-based: Limit based on requesting IP address. Simple but users behind NAT (same IP) have problems.

User-based: Limit based on authenticated user. Fairer. Identify user with API key or JWT.

Endpoint-based: Different limit for each endpoint. /login (5/min) vs /users (100/min).

Tiered: Different limits for different user types. Free (100/min), Pro (1000/min), Enterprise (10000/min).

Global vs per-endpoint: Global limit (for all API) + per-endpoint limit. Use both together.

Implementation

Redis: Store rate limit counters in Redis. Atomic counter with INCR and EXPIRE commands. Ideal for distributed rate limiting.

Middleware: Express.js (express-rate-limit), Django (django-ratelimit), Spring Boot (Bucket4j) middleware.

API Gateway: Rate limiting with Kong, AWS API Gateway, Cloudflare. Centralized management and monitoring.

Response headers: Return limit info with X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers.

Client SDK: Client libraries automatically retry and backoff by reading rate limit info.

DDoS Protection

Rate limiting alone doesn't provide DDoS protection. DDoS attacks come at volumes exceeding rate limit.

Cloudflare: DDoS protection, WAF (Web Application Firewall), bot management. Free tier available.

AWS Shield: DDoS protection for AWS services. Standard (free) and Advanced (paid).

IP reputation: Block IPs with bad reputation. Use reputation lists like Spamhaus, AbuseIPDB.

CAPTCHA: Verify suspicious traffic with CAPTCHA. reCAPTCHA v3 (invisible) or hCaptcha.

Geo-blocking: Block traffic from specific countries (if necessary).

Best Practices

Graceful degradation: Give clear error message to user when rate limit exceeded. Specify when to retry with Retry-After header.

Monitoring: Monitor rate limit hits. Abnormal increase may indicate attack or bug.

Whitelist: Whitelist trusted IPs (internal services, partner APIs).

Documentation: Clearly state rate limit policy in API documentation. Limit, window, and retry info.

Testing: Test rate limit behavior with load testing. Use k6, Artillery, or JMeter.