Rate Limiter

One client can take down the API for everyone

No cap on requests → a buggy retry loop, a scraper, or an abusive client floods an endpoint, exhausts CPU / DB connections, and every other user pays the price.

// naive endpoint — no limit at all
app.get('/api/search', (req, res) => {
  runExpensiveQuery(req.query.q)  // ← 10,000 req/s from one client
    .then(r => res.json(r));
});

Token Bucket: a budget that refills over time

A bucket holds up to N tokens and refills R tokens/sec. Each request consumes one token; an empty bucket rejects the request (HTTP 429).

class TokenBucket {
  tokens = N; cap = N; rate = R;

  allow() {
    if (this.tokens > 0) {
      this.tokens--;
      return true;   // 200 OK
    }
    return false;    // 429
  }

  refill() {             // every 1/R sec
    this.tokens = Math.min(this.cap, this.tokens + 1);
  }
}

Drain the bucket, then refill it

Bucket cap is 5. Click Request to spend a token — empty bucket means rejected (429). Click Tick to simulate one refill interval (+1 token, capped at 5).

Cheap insurance against runaway clients

• Protects resources + fairness: one noisy client can't starve everyone else.
• Smooths bursts: short spikes are absorbed by banked tokens instead of hammering the backend.
• Key by client: per-user or per-IP buckets, not one global counter.
• Distributed limiters share bucket state in Redis (or similar) so every API instance agrees on the count.
• Respond correctly: return 429 Too Many Requests with a Retry-After header.