--- title: Rate limiting in web applications - Concepts and approaches description: A broad conceptual walkthrough of rate limiting for web applications: why it matters (abuse, bursts, dependency throttling), a naive database-backed approach... canonical: https://daily.dev/posts/rate-limiting-in-web-applications---concepts-and-approaches-or8urxuvn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Rate limiting in web applications - Concepts and approaches | daily.dev og:description: A broad conceptual walkthrough of rate limiting for web applications: why it matters (abuse, bursts, dependency throttling), a naive database-backed approach... og:url: https://daily.dev/posts/rate-limiting-in-web-applications---concepts-and-approaches-or8urxuvn og:image: https://api.daily.dev/og/posts/OR8UrXuvn.png og:image:alt: Rate limiting in web applications - Concepts and approaches og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Rate limiting in web applications - Concepts and approaches **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 21 min read · 0 upvotes · 0 comments ## Summary A broad conceptual walkthrough of rate limiting for web applications: why it matters (abuse, bursts, dependency throttling), a naive database-backed approach and why it doesn't scale, the two main algorithm families (fixed window/quantized buckets vs token buckets), and the key design decisions - which resources to limit, how to set limits, whether to allow bursts, what identifier to partition on, which exceptions to carve out, how to communicate limiting to clients (status codes, headers like GitHub's x-ratelimit-*), where to store counters, and where in the stack to enforce limits (CDN, reverse proxy, application). Uses .NET/ASP.NET Core examples but frames the concepts as framework-agnostic. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What's the difference between fixed window and token bucket rate limiting algorithms? Fixed window (quantized bucket) limiting counts requests within a set time slice, like 100 per minute, but can let bursts slip through at window boundaries, allowing up to double the intended limit if requests cluster around the edge. Token bucket limiting instead fills a bucket with tokens at a steady replenishment rate and consumes one per request, which avoids boundary overruns while still allowing short traffic bursts up to the bucket's capacity before throttling kicks in. _Compare rate limiting algorithm trade-offs on daily.dev before picking one for an API._ ### What HTTP status code should I return when a client exceeds an API rate limit? There's no single mandated standard, but 429 Too Many Requests is the most common convention, though some services use 403 Forbidden (like GitHub) or 503 Service Unavailable instead. GitHub's API responses include x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-used, and x-ratelimit-reset headers so clients can see their quota and know when to retry. _Developers shaping API rate limit responses can check real-world header conventions on daily.dev._ ### What identifiers can I use to partition rate limits across users? Common partition keys include endpoint, IP address, authenticated user, session, browser, or a custom header like X-Api-Token. Each has trade-offs: IP addresses can be shared behind NAT or CGNAT, anonymous users need a fallback identifier, and sessions can multiply across devices, so many applications combine per-endpoint limits with per-user identification for accuracy. _daily.dev helps engineers weighing partitioning strategies for API rate limits dig into the specifics._ ## Similar posts on daily.dev - [Rate Limiting Algorithms: Token Bucket vs Sliding Window vs Fixed Window](https://daily.dev/posts/rate-limiting-algorithms-token-bucket-vs-sliding-window-vs-fixed-window-c6i3q4jdl) · Arcjet · 0 upvotes · 0 comments - [Rate Limiting Your SaaS API: A 2026 Developer Guide](https://daily.dev/posts/rate-limiting-your-saas-api-a-2026-developer-guide-mozn1rshe) · Alex CloudStar · 0 upvotes · 0 comments - [Rate limiting for LLM applications: Why it matters and how to implement it](https://daily.dev/posts/rate-limiting-for-llm-applications-why-it-matters-and-how-to-implement-it-xodmsr6nv) · portkey · 0 upvotes · 0 comments --- Tags: [#architecture](https://daily.dev/tags/architecture), [#distributed-systems](https://daily.dev/tags/distributed-systems), [#redis](https://daily.dev/tags/redis), [#aspnet](https://daily.dev/tags/aspnet) [View this post on daily.dev](https://daily.dev/posts/rate-limiting-in-web-applications---concepts-and-approaches-or8urxuvn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Rate limiting in web applications - Concepts and approaches","url":"https://daily.dev/posts/rate-limiting-in-web-applications---concepts-and-approaches-or8urxuvn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rate-limiting-in-web-applications---concepts-and-approaches-or8urxuvn"},"datePublished":"2026-10-04T13:04:19.177Z","dateModified":"2026-10-04T13:05:19.106Z","description":"A broad conceptual walkthrough of rate limiting for web applications: why it matters (abuse, bursts, dependency throttling), a naive database-backed approach...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/25aeef5473bcf836924a99cbc6bb1e0f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/25aeef5473bcf836924a99cbc6bb1e0f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rate-limiting-in-web-applications---concepts-and-approaches-or8urxuvn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"architecture,distributed-systems,redis,aspnet","timeRequired":"PT21M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"Rate limiting in web applications - Concepts and approaches"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rate-limiting-in-web-applications---concepts-and-approaches-or8urxuvn#faq","mainEntity":[{"@type":"Question","name":"What's the difference between fixed window and token bucket rate limiting algorithms?","acceptedAnswer":{"@type":"Answer","text":"Fixed window (quantized bucket) limiting counts requests within a set time slice, like 100 per minute, but can let bursts slip through at window boundaries, allowing up to double the intended limit if requests cluster around the edge. Token bucket limiting instead fills a bucket with tokens at a steady replenishment rate and consumes one per request, which avoids boundary overruns while still allowing short traffic bursts up to the bucket's capacity before throttling kicks in. Compare rate limiting algorithm trade-offs on daily.dev before picking one for an API."}},{"@type":"Question","name":"What HTTP status code should I return when a client exceeds an API rate limit?","acceptedAnswer":{"@type":"Answer","text":"There's no single mandated standard, but 429 Too Many Requests is the most common convention, though some services use 403 Forbidden (like GitHub) or 503 Service Unavailable instead. GitHub's API responses include x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-used, and x-ratelimit-reset headers so clients can see their quota and know when to retry. Developers shaping API rate limit responses can check real-world header conventions on daily.dev."}},{"@type":"Question","name":"What identifiers can I use to partition rate limits across users?","acceptedAnswer":{"@type":"Answer","text":"Common partition keys include endpoint, IP address, authenticated user, session, browser, or a custom header like X-Api-Token. Each has trade-offs: IP addresses can be shared behind NAT or CGNAT, anonymous users need a fallback identifier, and sessions can multiply across devices, so many applications combine per-endpoint limits with per-user identification for accuracy. daily.dev helps engineers weighing partitioning strategies for API rate limits dig into the specifics."}}]} ```