80/20 Of The Week … Rate Limiting and Backpressure
Basic enough for a change lol
- What is rate limiting
Rate limiting is about controlling how much traffic a client, user, service, or tenant can send in a given time.(duhhh)
For example:
- 100 requests per minute per user
- 10 login attempts per 5 minutes
- 1000 API calls per hour per API key
The goal is not just security but also system stability and fairness.
Without limits, one noisy client can eat resources and hurt everyone else.
- Why it matters
Every system has limits.
CPU, memory, DB connections, thread pools, queues, downstream APIs… all of them are finite.
So if traffic keeps coming in faster than the system can safely process it, one of two things happens:
latency keeps growing… or the system starts failing unpredictably
That is where rate limiting helps since it puts a boundary in front of the system.
Instead of letting traffic flood everything behind it, you control how much gets through.
- Rate limiting strategies
A few common ones are:
- Fixed window-simple, but can be bursty at window boundaries
- Sliding window-smoother and more accurate
- Token bucket-allows controlled bursts while enforcing an average rate
- Leaky bucket-smooths traffic into a more constant flow
The core idea in all of them is the same… don’t let incoming traffic exceed what the system can safely handle
- Where backpressure comes in
Rate limiting and backpressure are related, but they are not exactly the same thing.
Rate limiting says: “I will only accept this much traffic.” Backpressure says: “I am overloaded, so upstream needs to slow down.”
Backpressure is what happens when one part of the system cannot keep up, and that pressure starts pushing backward through the chain.
For example: DB gets slow, service threads get stuck, queue grows, API latency rises, upstream services now also start slowing down
If you don’t control that properly, overload spreads.
That is how one slow dependency can poison the rest of the system.
- What proper systems do
Good systems do not just blindly accept traffic until they collapse. They apply control and that can mean: -rejecting excess traffic early -slowing producers down -buffering carefully -dropping non-critical work -prioritizing important requests -returning 429 or 503 intentionally instead of timing out randomly
That is much healthier than pretending infinite scale exists.
- TLDR Rate limiting is not just about stopping abuse, it is about protecting system capacity.
And backpressure is not just a “problem.”
It is a signal that the system is reaching a point where demand is higher than safe throughput.
The best systems do not ignore that signal.
They respond to it early and intentionally.
#Backend #SystemDesign #DistributedSystems #RateLimiting #Backpressure #Microservices #SoftwareEngineering
