Where to place the rate limiter:
- Client-side: Easy to bypass. Not secure.
- Server-side: Reliable but adds latency to every request.
- Middleware/API Gateway: Clean separation. Most common.
Distributed rate limiting:
If you have servers, each tracking locally, a client could make requests to each = total.
Solution: Use a centralized store (Redis) to track counts.
Design:
- Request arrives at API Gateway
- Gateway checks Redis: INCR user:{id}:minute:{timestamp}
- If count > limit, return
- Else, forward to application server