Rate Limiting

Edge Cases

Rate Limit Flow

flowchart TD
    A([Start: Rate Limiting]) --> B[Analyze endpoints + requirements]
    B --> C{Algorithm selection?}
    C -- Simple, no burst needed --> D[Fixed window: easy but burst at boundary]
    C -- Accurate, low volume --> E[Sliding window log: precise, memory-heavy]
    C -- Balanced accuracy + memory --> F[Sliding window counter: recommended default]
    C -- Controlled burst allowed --> G[Token bucket: allows short bursts]
    D & E & F & G --> H{Deployment: single or distributed?}
    H -- Single instance --> I[In-memory counter acceptable]
    H -- Multiple instances --> J[Redis required for shared counter]
    I & J --> K[Identify rate limit key]
    K --> L{Key type?}
    L -- Public API --> M[Key by IP address]
    L -- Authenticated API --> N[Key by user ID or API key]
    L -- Mixed --> O[Key by user ID if auth, else IP]
    M & N & O --> P[Atomic check-and-increment in Redis]
    P --> Q{Limit exceeded?}
    Q -- Yes --> R[Return 429 + Retry-After header]
    Q -- No --> S[Add headers: X-RateLimit-Limit, Remaining, Reset]
    R & S --> T{Bypass rules needed?}
    T -- Yes --> U{Bypass type?}
    U -- Internal service --> V[Check shared secret header]
    U -- Admin user --> W[Check user role / API key whitelist]
    U -- IP whitelist --> X[Check CIDR range]
    T -- No --> Y
    V & W & X & Y --> Z{Redis unavailable?}
    Z -- Fail open --> AA[Allow all requests, log warning]
    Z -- Fail closed --> AB[Block all requests, return 503]
    AA & AB --> AC[Emit metrics: hits, exceeded, bypassed]
    AC --> AD([Output: Rate limiting middleware with bypass + monitoring])

Examples

• Input Example
• Output Example

Quality Gate

1. Are operations atomic (Redis)?
2. Are standard headers included?
3. Is bypass logic secure?
4. Are failure modes handled?
5. is it performance-tuned?

MCP Dependencies

• @upstash/context7-mcp: Library documentation and examples.

Changelog