implementing-api-rate-limiting-and-throttling

name	implementing-api-rate-limiting-and-throttling
description	Use when implements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms to protect against brute force attacks, credential stuffing, resource exhaustion, and API abuse. The engineer configures per-user, per-IP, and per-endpoint rate limits using Redis-backed counters, API gateway plugins, or application middleware, and implements proper HTTP 429 responses with Retry-After headers.
domain	cybersecurity
tags	["api-security","rate-limiting","throttling","redis","token-bucket","abuse-prevention"]
subdomain	api-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Implementing Api Rate Limiting And Throttling

Overview

Cybersecurity skill for implementing api rate limiting and throttling. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "implementing api rate limiting and throttling"

• "Implements API rate limiting and throttling controls using token bucket, sliding"

• Protecting authentication endpoints against brute force and credential stuffing attacks

• Preventing API abuse and resource exhaustion from automated scripts and bots

• Implementing fair usage quotas for different API consumer tiers (free, premium, enterprise)

• Defending against denial-of-service attacks at the application layer

• Meeting compliance requirements that mandate API abuse prevention controls

Do not use rate limiting as the sole defense against attacks. Combine with authentication, authorization, and WAF rules.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Redis 6.0+ for distributed rate limit counters (or in-memory for single-instance deployments)
• API framework (Express.js, FastAPI, Spring Boot, or Django REST Framework)
• Monitoring system for rate limit metrics (Prometheus, CloudWatch, Datadog)
• Understanding of the API's normal traffic patterns and peak usage
• Load testing tool (k6, Gatling, or Locust) for validating rate limit behavior

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}