Rate Limiter Skill

Design rate limiting.

Algorithms

Token Bucket:

• Tokens added at fixed rate
• Each request consumes a token
• Allows bursts up to bucket size
• Best for: API rate limiting

Fixed Window:

• Count requests per time window
• Reset at window boundary
• Simple but has burst-at-boundary issue
• Best for: Simple quotas

Sliding Window:

• Weighted combination of current and previous windows
• Smooths out boundary bursts
• Best for: Precise rate limiting

Express.js Example

const rateLimit = new Map();

function limiter(req, res, next) {
  const key = req.ip;
  const now = Date.now();
  const window = 60000; // 1 minute
  const limit = 100;
  
  const record = rateLimit.get(key) || { count: 0, start: now };
  if (now - record.start > window) {
    record.count = 0;
    record.start = now;
  }
  record.count++;
  rateLimit.set(key, record);
  
  if (record.count > limit) return res.status(429).json({ error: "Too many requests" });
  next();
}

Guidelines

• Return 429 status with Retry-After header
• Consider per-user vs per-IP limits
• Use Redis for distributed systems