Rate limiting and backpressure
Protecting a service that receives more than it can handle: limiting the rate, choosing the algorithm, telling clients to slow down, pushing back and shedding load before collapsing. Every answer explained.
- 33 cards
- 3 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Rate limiting
- The algorithms
- Backpressure and load shedding
A few cards from the deck
What is “rate limiting”?
Show the answer
Capping how many requests a client can make over a period
It protects the service from abuse and greedy clients, and shares capacity fairly among everyone.
Which HTTP status does a service return when a client exceeds its rate limit?
- 429 Too Many Requests
- 403 Forbidden
- 500 Internal Server Error
- 404 Not Found
Show the answer
429 Too Many Requests
The 429 says “too many requests, try again later”, often with a Retry-After header saying when.
Capping how many requests a client can make over a period: what is this called?
Show the answer
rate limiting
It protects the service from abuse and greedy clients, and shares capacity fairly among everyone.
An API limits the rate per IP address. What problem does that raise?
- All users behind one shared address (company, mobile network) share the same limit
- IP addresses change too slowly
- It prevents encryption
- None, it is always the best key
Show the answer
All users behind one shared address (company, mobile network) share the same limit
Many people reach the Internet through the same address. When possible, limit per account or API key instead, and per address only for anonymous requests.