API Gateway & Rate Limiting Flashcards

Which rate limiting algorithm uses a continuously refilling virtual container to smooth out traffic bursts?

Answer: Token bucket

The token bucket algorithm refills tokens at a fixed rate and allows bursts up to the bucket capacity.

An API gateway sitting in front of a CDN origin needs to enforce per-client quotas. Which HTTP header should the gateway return to tell clients when their quota resets?

Answer: X-RateLimit-Reset

X-RateLimit-Reset is the de facto standard header conveying the Unix timestamp when the rate limit window resets.

A CDN's API gateway authenticates requests using JWT. Where should the gateway validate the JWT signature?

Answer: At the API gateway entry point before routing

JWT validation at the API gateway entry point ensures unauthenticated requests are rejected before consuming backend resources.

Which strategy allows an API gateway to enforce rate limits consistently across multiple geographically distributed edge nodes?

Answer: Centralized distributed cache (e.g., Redis)

A centralized distributed cache like Redis lets all edge nodes share and atomically update the same rate limit counters.

What HTTP status code should an API gateway return when a client exceeds its rate limit?

Answer: 429 Too Many Requests

RFC 6585 defines 429 Too Many Requests as the correct response when a client has exceeded the allowed rate.

In an API gateway context, what is 'request throttling' as opposed to 'rate limiting'?

Answer: Throttling slows down processing speed; rate limiting caps request count

Throttling reduces the speed at which requests are processed, while rate limiting enforces a maximum number of requests in a time window.

A CDN provider offers tiered API plans. Which rate limiting key granularity best supports per-plan enforcement?

Answer: API key or subscription tier identifier

Using the API key or subscription tier as the rate limit key allows distinct quotas to be applied per plan regardless of client IP.