Rate limit

Overview

Rate limiting (capping how often requests can be sent) is a technique that limits the number of requests from a particular source per unit of time. For example, you set an upper limit such as "up to 10 requests per second from the same IP address" and reject any requests over it. It is used for a wide range of purposes, such as preventing server overload, deterring spam posts, and making sure an API is used fairly.

Main algorithms

There are several algorithms for implementing a rate limit. The simplest is the fixed window method, which resets a counter every set period (for example, 1 minute). It is easy to implement, but it has the problem that across the boundary between windows, up to twice the limit can get through in a short time.

The sliding window method constantly tracks the number of requests in the last N seconds. It solves the boundary problem of fixed windows, but it is a little more complex to implement. The token bucket method uses a bucket that is refilled with tokens at a steady rate, and each request uses up a token. It can allow a certain amount of bursty requests while preventing sustained overload.

Use in services like question boxes

Services like question boxes also use rate limits on anonymous question posts. By setting a cap on how often the same source can post at a level that normal use would almost never reach, they can slow down the pace of harassment posted by hand while keeping the effect on regular users low.

Unlike Proof of Work and honeypots, rate limiting also works against manual harassment by people. Because it plays a part in countering both bots and people, it is one of the elements that make up a layered defense.