Art and Science of Rate Limits for APIs
summary
APIdays Hong Kong 2020 frames rate limits as both security and business controls, citing a national ID API that leaks large chunks of data because no rate limits let an authenticated partner pump requests; breaches cluster around broken authentication plus absent throttles. Solutions span enforcing limits at proxy/gateway versus backend, identifying callers by IP or JWT/API key, algorithms like token bucket and leaky bucket, throttling versus instant 429 drops, and cross‑datacenter sync via shared counters or DNS sticky routing.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:59Breach Lesson
- 6:29Who is responsible
- 7:49Collective responsibility
- 8:48How will APIs be controlled
- 10:12What are the approaches
- 14:02What happens after the mechanism is in place
- 15:41Rate limiting algorithms
- 17:45Use cases
- 20:23Deployment considerations
- 23:25External factors
- 23:51Conclusion
related talks
26mTraffic Management w. Rate Limiting to Ensure API Scalability & Resiliency
54mFive-step plan for securing your APIs
50mRate Limiting in Node js applications
25mSecuring your APIs at Scale
25mThe Hidden Currents of API Consumption
21mAPI Security & Performance for Gaming
32mApisecure, 14 & 15 March 2023 - Shannon Wilkinson, Cybersecurity Founder | Women in Technology [...]
50mCommon API security pitfalls