1 min read
Rate limiting you can actually reason about
Token buckets per IP, why the reaper matters, and how to pick a burst that doesn't punish real humans.
Rate limiting fails in two directions: too strict (a page load that fires
five parallel requests gets a 429) or too loose (meaningless). The token
bucket is the right primitive — the trick is choosing limits that match
user behavior, not attacker imagination.
My defaults for a personal site: 20 requests/minute globally per IP with
burst 40, because a human loading a page with htmx partials will happily
fire a burst of 6 in one second. The contact form is a different beast:
5 per hour, burst 1 — nobody legitimate sends six contact messages an
hour, and spam robots don't wait politely.
Two operational notes: bound the bucket map (idle reaper, or a
spoofed-X-Forwarded-For attacker grows it forever), and log rejections at
info level — your future self will want the histogram.