Hint 1 — locked

Hint 2 — locked

Hint 3 — locked

Problem

Build a distributed rate limiter that can be placed in front of any API to throttle requests per user or IP address. It should support sliding-window and token-bucket algorithms and work correctly across multiple server instances without over- or under-counting requests.

Functional Requirements

• Allow or reject incoming requests based on user/IP quota
• Support configurable limits (e.g. 1000 req/min per user)
• Return HTTP 429 with Retry-After header when limit exceeded
• Support multiple algorithms (token bucket, sliding window)
• Counters must be consistent across all server instances

Non-Functional

• Decision latency < 5 ms (must not add perceptible overhead)
• Works across horizontally scaled API servers
• No single point of failure — degradation mode allows traffic
• 1M requests per second peak throughput