Overview
Design rate limiting middleware that runs in several regions and enforces a per-client limit, for example 100 requests a minute per IP address or API key.
Requirements
- 01Enforce the limit per user ID, API key, or client IP
- 02Return HTTP 429 with retry headers when a client goes over its limit
- 03Add no more than 2ms to the request
- 04Keep one consistent count across gateway instances, with no race conditions
- 05Support tiered limits and configurable windows
Concepts in play
Token BucketRedis LuaAPI GatewayDistributed Locks