ARTICLE · Systems
Rate limiting
Rate limiting makes a scarce service shareable by deciding how much work one caller may ask it to perform within a period.
Rate limiting
YouTube stays disconnected until you choose to load this player. Loading connects to Google/YouTube, which receives your IP address and may use cookies or browser storage.
A guild clerk can process only so many requests. If one person repeatedly slams the bell, everyone else loses access even when that person's individual requests are valid. A rate limit gives the clerk a rule for saying “not yet.”
The rule needs three parts: what is counted, who shares the allowance, and how time replenishes it. Ten login attempts per address in a minute is different from a monthly token budget per account. One counts requests; the other counts a resource whose cost can vary dramatically between requests.
Fairness depends on the identity you count#
An IP address may represent one person or an entire school behind a shared connection. An account identifies a signed-in user, but it does not help with anonymous login attempts. Choosing the key is therefore a product decision as well as an implementation detail.
The response should help a legitimate caller recover. A 429 and suitable retry guidance are more useful than an unexplained timeout. A client that immediately retries every refusal can otherwise make the overload worse.
Barrier Magic gives the limit a concrete job around authentication. As you follow it, notice which routes share a counter. A registration attempt and a login attempt can draw from the same allowance if they use the same limiter instance.
See also