Rate limiter
0-day streakReview

Your progress

Level 1

0 XP100 XP to level 2
0day streak
0best streak
0topics started
0cards reviewed
    Review cards

    Progress is stored only in this browser. No account is required.

    Layer 3 · Go deeper · 11 min

    Go deeper

    Size it, build it, then make the calls an interviewer will push you on.

    Back of the envelope

    Size it up

    Tap through each step of the arithmetic.

    How many Redis primaries does the counter store need?

      Does memory limit the counter store?

        How much latency does one check add?

          Why put a separate service between the gateways and Redis?

            Build-up · 5 steps

            Build the high-level design

            One functional requirement at a time, ending with a limiter that works in one region at modest traffic.

            Step 1 of 5

            Limit per identity, per rule

            The gateway knows the caller after auth and asks a stateless rate-limit service. It builds one key per rule, like rl:{k_8f2a}:pay-burst, and one Redis script checks and updates the counter.

            6 interview moments

            You’re the candidate

            The interviewer pushes on the hard parts. Pick an approach and see how it holds up.

            1. Deep dive 1 of 6

              Interviewer

              “Payments allow 20 calls a second per key, and one app screen fires a dozen at once. Which algorithm?”

              Your move. Pick an approach:

            2. Deep dive 2 of 6

              Interviewer

              “A hundred limiter pods share counters in Redis, and one key sends thousands of requests a second. How do you update a count?”

              Your move. Pick an approach:

            3. Deep dive 3 of 6

              Interviewer

              “One partner sends 40% of all traffic, 400k requests a second on one API key. Its shard is budgeted for 40k. What do you do?”

              Your move. Pick an approach:

            4. Deep dive 4 of 6

              Interviewer

              “A Redis shard is failing over in the middle of the evening peak. What does the rate-limit service do?”

              Your move. Pick an approach:

            5. Deep dive 5 of 6

              Interviewer

              “You run active-active in Mumbai, Hyderabad and Singapore. A partner may send 1,000 requests a minute in total. Where does the counter live?”

              Your move. Pick an approach:

            6. Deep dive 6 of 6

              Interviewer

              “Someone types window: 1d instead of 1m on the UPI collect endpoint. How do you stop that becoming an outage?”

              Your move. Pick an approach:

            Build-up · 7 steps

            Follow one payment request through it

            The hot path is the gateway, the rate-limit service and Redis, bounded by a 3 ms deadline. Everything else is asynchronous or off to the side.

            Step 1 of 7

            Edge guard

            The gateway first checks its in-memory deny cache and a coarse local bucket set well above any real customer’s rate. Floods and already-blocked keys stop here at almost zero cost.