Rate limiting algorithms (token bucket, leaky bucket) in HLD - Architecture Diagram

System Overview - Rate limiting algorithms (token bucket, leaky bucket)

This system controls how many requests a user can make to a service in a given time. It uses two common methods: the token bucket and the leaky bucket algorithms. The goal is to prevent overload and ensure fair use by limiting request rates smoothly and predictably.

Architecture Diagram

User
  |
  v
Load Balancer
  |
  v
API Gateway
  |
  +-------------------+
  | Rate Limiter      |
  |  - Token Bucket   |
  |  - Leaky Bucket   |
  +-------------------+
  |
  v
Service
  |
  v
Database

Cache (for tokens/state) <-> Rate Limiter

Components

User

client

Sends requests to the system

Load Balancer

load_balancer

Distributes incoming requests evenly to API Gateway instances

API Gateway

api_gateway

Entry point for requests; forwards to Rate Limiter

Rate Limiter

service

Applies token bucket or leaky bucket algorithm to limit request rate

Cache

cache

Stores token/leaky bucket state for fast access

Service

service

Processes allowed requests

Database

database

Stores persistent data for the service

Request Flow - 10 Hops

User → Load Balancer

Load Balancer → API Gateway

API Gateway → Rate Limiter

Rate Limiter → Cache

Rate Limiter → API Gateway

API Gateway → Service

Service → Database

Service → API Gateway

API Gateway → Load Balancer

Load Balancer → User

Failure Scenario

Component Fails:Cache

Impact:Rate limiter cannot quickly read or update token/leaky bucket state, causing slower rate limit checks or temporary incorrect limits.

Mitigation:Fallback to database for state storage with higher latency; implement retries and circuit breakers to avoid overload.

Architecture Quiz - 3 Questions

Which component is responsible for enforcing the rate limit algorithms?

A API Gateway

B Load Balancer

C Rate Limiter

D Cache

Design Principle

This architecture uses a dedicated Rate Limiter service with fast cache access to efficiently enforce rate limits using token bucket and leaky bucket algorithms. The separation of concerns and fallback mechanisms ensure scalability and reliability under load.

Practice

1. Which rate limiting algorithm allows short bursts of traffic by accumulating tokens over time?

easy

A. Token Bucket

B. Leaky Bucket

C. Fixed Window Counter

D. Sliding Log

Solution

1. Step 1: Understand token bucket behavior

   The token bucket algorithm accumulates tokens at a fixed rate, allowing bursts when tokens are available.

2. Step 2: Compare with leaky bucket

   The leaky bucket processes requests at a steady rate, smoothing bursts rather than allowing them.

3. Final Answer:

   Token Bucket -> Option A

4. Quick Check:

   Token Bucket = allows bursts [OK]

Hint: Token bucket = bursts allowed, leaky bucket = steady flow [OK]

Common Mistakes:

• Confusing leaky bucket with token bucket
• Thinking fixed window allows bursts
• Mixing sliding log with token bucket

2. Which of the following is the correct description of the leaky bucket algorithm?

easy

A. Requests are counted in fixed time windows

B. Tokens accumulate and requests consume tokens

C. Requests are processed at a fixed rate regardless of burst

D. Requests are logged with timestamps for sliding window

Solution

1. Step 1: Recall leaky bucket mechanism

   Leaky bucket processes requests at a constant rate, smoothing out bursts by queuing excess requests.

2. Step 2: Eliminate other options

   Tokens accumulate and requests consume tokens describes token bucket, C and D describe other rate limiting methods.

3. Final Answer:

   Requests are processed at a fixed rate regardless of burst -> Option C

4. Quick Check:

   Leaky bucket = fixed rate processing [OK]

Hint: Leaky bucket = steady output rate, no bursts allowed [OK]

Common Mistakes:

• Confusing token accumulation with leaky bucket
• Mixing fixed window counting with leaky bucket
• Assuming leaky bucket allows bursts

3. Consider a token bucket with a capacity of 5 tokens and a refill rate of 1 token per second. Initially, the bucket is full. If 7 requests arrive instantly, how many requests will be allowed immediately?

medium

A. 5

B. 7

C. 1

D. 0

Solution

1. Step 1: Understand token bucket capacity and refill

   The bucket starts full with 5 tokens, each request consumes one token.

2. Step 2: Calculate allowed requests

   Since 7 requests arrive instantly but only 5 tokens are available, only 5 requests are allowed immediately.

3. Final Answer:

   5 -> Option A

4. Quick Check:

   Tokens available = 5, requests = 7, allowed = 5 [OK]

Hint: Max allowed = tokens in bucket at request time [OK]

Common Mistakes:

• Assuming all 7 requests allowed instantly
• Ignoring token bucket capacity
• Confusing refill rate with immediate tokens

4. A developer implemented a leaky bucket rate limiter but notices that bursts are still allowed. What is the most likely cause?

medium

A. The bucket capacity is set too low

B. Requests are dequeued faster than the leak rate

C. Tokens are refilled too quickly

D. The leak rate is set to zero

Solution

1. Step 1: Analyze leaky bucket behavior

   Leaky bucket allows steady output by leaking requests at a fixed rate.

2. Step 2: Identify cause of bursts

   If requests are dequeued faster than the leak rate, bursts can pass through, breaking the smoothing effect.

3. Final Answer:

   Requests are dequeued faster than the leak rate -> Option B

4. Quick Check:

   Dequeue rate > leak rate = bursts allowed [OK]

Hint: Leaky bucket bursts mean dequeue faster than leak rate [OK]

Common Mistakes:

• Confusing token refill with leaky bucket
• Assuming bucket capacity controls bursts
• Ignoring dequeue speed vs leak rate

5. You need to design a rate limiter for an API that allows short bursts but enforces an average rate limit over time. Which algorithm should you choose and why?

hard

A. Leaky Bucket, because it smooths out bursts by processing requests steadily

B. Fixed Window Counter, because it counts requests in fixed intervals

C. Sliding Log, because it logs every request timestamp

D. Token Bucket, because it allows bursts by accumulating tokens and enforces average rate

Solution

1. Step 1: Understand requirement for bursts and average rate

   The system must allow short bursts but keep average rate limited over time.

2. Step 2: Match algorithm to requirement

   Token bucket allows bursts by using tokens that refill over time, enforcing average rate while permitting bursts.

3. Final Answer:

   Token Bucket, because it allows bursts by accumulating tokens and enforces average rate -> Option D

4. Quick Check:

   Bursts + average rate = Token Bucket [OK]

Hint: Token bucket = bursts + average rate control [OK]

Common Mistakes:

• Choosing leaky bucket which smooths bursts
• Confusing fixed window with burst allowance
• Ignoring average rate enforcement