Rate Limiting

In detail

Rate limiting is a server side control that caps the number of requests from a given client (by IP, API key, user account or other identifier) within a sliding or fixed time window. When the limit is exceeded, the server returns a 429 Too Many Requests response. Rate limiting defends against brute force attacks (password guessing, OTP enumeration), API abuse, denial of service from a single source, and unintentional traffic spikes from misbehaving clients. Systems typically implement it at the API gateway, load balancer or application middleware layer. Tools like Upstash Rate Limit, Cloudflare WAF and Express-rate-limit make it accessible to smaller applications.