Topic
A control that caps how many requests a client, tenant, or IP can make in a given time window, protecting services from overload or abuse.
One developer's free static host sent HTTP 429 to every visitor after a daily visit quota ran out, while its deploy API still reported the release ready. Both green signals, deploy status and a scripted check, missed a ceiling that sat on the serving path.
Reality
OpenAI and Qwen document eight billing and account errors under HTTP 429, a third of the 24 codes nine model vendors list there, a survey on dev.to found. Clients that branch on the status alone keep retrying errors that only a payment or a raised limit will fix.
Reality
A Cloudflare walkthrough lays out how a rule set at 20 requests per 10 seconds, tuned against a handful of testers, locks out players sharing one carrier address. The counting key that avoids it is gated to Enterprise.
Reality
Extending a PowerShell endpoint suite with roles, sessions and think time exposed authentication, contract, cleanup and rate-limit defects first. The nine journey sessions still share three accounts, one per role.
Reality
Every route in CogniPrep passes through five gates whose order is set by what each one costs to fail. The sharper detail in the writeup is the header parsing: the standard x-forwarded-for snippet lets any caller pick its own rate-limit key.
Reality
A dev.to layering guide for self-hosted Laravel admins runs from ufw defaults through ModSecurity to a five-per-minute login limiter. Both fail2ban and that limiter depend on resolving the real client IP.
Reality
The on-call platform keeps its rate-limiting counters in managed Valkey under a 99.99 percent SLA, and an intern project adds a local buffer for the busiest gates so that a store outage would not switch limiting off entirely.
Reality
A dev.to engineer moves the admit/deny verdict back into an in-process token bucket and wraps it so the five verdict words cannot reach a model call, arguing that a free inference tier still charges the defender under a flood.
Reality
Setting 5 requests per 60 seconds in Bijira's console took a form field and a dropdown. Working out what the gateway meant by 60 seconds took two corrected conclusions and a header that read 57 where a rolling window would have read 60.
Reality
Scry's MCP search API prices an over-quota query instead of refusing it. That moves congestion control into the agent's retry loop, where a backoff timer cannot see the quote and the budget arbiter is the orchestrator's problem.
Reality
A dev.to teardown argues static IP blocklists cannot survive CGNAT and 100,000-address proxy pools, so edge defence moves to the fields a kernel writes into the first SYN: initial window, MSS, option ordering.
Reality
A Go reverse proxy keeps its rate-limit counters in sketch tables allocated once at startup, so a million rotating IPs cost the same memory as a hundred requests. Its author concedes the flood still gets forwarded.
Reality
Lars Winstand traced 429s, doubled tool calls and inconsistent output in an n8n agent flow to a burst of simultaneous executions, and fixed it by capping production concurrency at 20 in the orchestrator.
Reality
SyllogOS layers a Cloudflare Free rate limit, Turnstile and an in-app limiter in front of one login form. The author's own published thresholds show which of the three actually caps a patient attacker.
Reality
A dev.to design note makes a renewal reminder's business deadline the primary SLO and moves the acknowledgement behind the durable write. A 429 becomes a budget that first attempts and retries have to share.
Reality
One interviewer's thirty-minute format hands candidates six seeded defects and grades the order they reach for them, which puts a reviewer's attention budget on the record in a way a whiteboard problem cannot.
Reality
The instance that answered the last request may not exist for the next one. A Map at module scope is therefore storage with no defined lifetime, and the symptom is data that changes between identical calls.
Reality
A dev.to walkthrough shows the boundary bypass on a 100-per-minute cap. The weighted fix cuts the burst to 102, and charges an innocent front-loaded client 98 requests it has already spent.
Reality
A limit of 100 per minute becomes 200 the moment a second worker keeps its own counter, and whatever the storage adapter does on a timeout decides who gets in when the backend dies.
Reality
A dev.to field report argues the ten-line in-memory limiter multiplies your limit by warm instance count, and that path-based middleware rules cannot see a Server Action at all.
Reality
Build · August 14, 2026 · 1 publisher