rate-limiting

Implement server-side and distributed rate limiting with Bucket4j, Resilience4j, and Redis.

Updated Jun 25, 2026
One-click install
npx skills add https://github.com/oriddd/ai-toolkit --skill rate-limiting-oriddd
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: rate-limiting
Source: https://github.com/oriddd/ai-toolkit/tree/main/copilot/public/skills/rate-limiting
Command: npx skills add https://github.com/oriddd/ai-toolkit --skill rate-limiting-oriddd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Services can be overwhelmed by abusive or accidental traffic spikes, whether from DoS attacks or misbehaving client scripts. This Skill provides concrete patterns for enforcing request limits so a single client cannot degrade the service for everyone. ## Core Features & Use Cases - Multiple Limiting Strategies: Covers fixed window, sliding window, and token bucket algorithms with guidance on when each applies. - Server-Side Enforcement: Shows in-process limiting with Resilience4j configuration and Bucket4j Java code for local buckets. - Distributed Limiting: Explains Redis-backed Bucket4j counters so multi-node deployments share a global limit instead of multiplying it per pod. - Use Case: A public REST API running on three Kubernetes pods needs a per-user limit of 100 requests per minute. Use Redis + Bucket4j so the limit holds globally, and return 429 with a Retry-After header when exceeded. ## Quick Start Apply the rate-limiting skill to add a Bucket4j-based per-user limit with a 429 response to my REST controller.

Frequently Asked Questions about rate-limiting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement rate limiting in a Spring Boot API?

Use Bucket4j to build a bucket with a bandwidth limit, then call tryConsume before executing the request. Alternatively configure Resilience4j ratelimiter instances in YAML with limitForPeriod and limitRefreshPeriod for declarative enforcement.

Bucket4j vs Resilience4j for rate limiting?

Resilience4j suits fixed-size clusters and simple concurrency protection via YAML configuration. Bucket4j offers finer control in code and integrates with Redis for distributed counters when running multiple service instances.

How do I rate limit across multiple service instances?

Use Redis with Bucket4j to maintain a shared counter across all nodes. Local in-process buckets let a client multiply its limit by hitting different pods, so a distributed store is required for global consistency.

What HTTP response should a rate-limited request return?

Return 429 Too Many Requests with a Retry-After header indicating seconds or a timestamp. Include a clear message so clients know when they can safely retry.

When should I not use local rate limiting?

Avoid local limiting when global consistency is required across a cluster; use Redis instead. Also never apply global limits to internal health-check endpoints, and do not use rate limiting as a substitute for optimizing slow code.