Backend Developer interview question
How do you implement rate limiting?
Rate limiting protects a finite resource by defining scope, window, burst and response behaviour. Apply it at the earliest trusted boundary and return clear retry information.
Direct answer
What a strong answer covers
How it works
A rate limit is a policy: what is being counted, per which identity, over which window, with how much burst, and what the caller sees when refused. Token bucket and sliding window are the common algorithms; fixed windows are simpler but allow double traffic at the boundary. Enforce it at the edge for cheap rejection and again in the service for accuracy, keep the counters in a shared store when there are many instances, and return 429 with Retry-After so well-behaved clients back off instead of hammering.
Example
A token bucket per API key permits short bursts while enforcing a sustainable average request rate. Counters live in Redis with an atomic Lua script, the gateway rejects at 120 percent of the quota to shed load early, and internal callers are limited separately so an internal loop cannot exhaust a customer’s quota.
Common mistakes
- Keying the limit on client IP alone and throttling every user behind one corporate NAT.
- Keeping counters in process memory so each instance enforces its own limit.
- Returning 429 without Retry-After and leaving clients to guess how long to wait.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.