Rate Limiting

Definition: Rate limiting is a technique that limits how many requests or operations a client can make within a certain amount of time.
It protects a system from overload, excessive resource usage, abuse, and some denial-of-service attacks. (MDN Web Docs)

Simple example

Suppose your API has:

Maximum: 100 requests / minute / user

A user sends:

Request 1   ✓
Request 2   ✓
...
Request 100 ✓
Request 101 ❌

The server can respond with:

HTTP 429 Too Many Requests

and may include Retry-After to tell the client when to try again. (MDN Web Docs)

3 examples

1. Login

5 login attempts / minute

This prevents someone from continuously trying passwords against an account.

2. API

1000 requests / hour / user

If a user exceeds the limit, additional requests are rejected or delayed.

3. SMS verification

3 OTP requests / 10 minutes / phone number

This prevents someone from repeatedly requesting SMS messages and potentially abusing the service.

Where can it be applied?

Rate limits can be based on different things:

IP address
     ↓
User
     ↓
API key
     ↓
Endpoint
     ↓
Resource

For example, you might allow a normal user 100 requests/minute, but allow only 5 password-reset requests/hour. OWASP recommends tuning limits according to the specific operation and business requirements. (GitHub)

Rate limiting vs. throttling

You’ll often hear these terms together. Rate limiting defines how much traffic/operation is allowed; throttling generally means slowing or restricting activity when the limit is approached or exceeded. In practice, the terms are often used interchangeably. (MDN Web Docs)

Easy way to remember:

Rate limiting = “You can do this X times within Y time.”
Example: 100 API requests per minute per user.