Rate limiter with INCR and EXPIRE in Redis

Introduction

A rate limiter helps control how often a user or system can perform an action. Using Redis commands INCR and EXPIRE makes it simple and fast.

To limit login attempts from a user to prevent brute force attacks.

To restrict API calls per user or IP address to avoid overload.

To control message sending frequency in a chat application.

To prevent excessive form submissions on a website.

To throttle requests to a backend service during peak times.

Syntax

Redis

INCR key
EXPIRE key seconds

INCR increases the number stored at key by 1. If the key does not exist, it is set to 0 before incrementing.

EXPIRE sets a time-to-live (TTL) in seconds for the key. After this time, the key is deleted automatically.

Examples

This increments the request count for user 123 and sets the count to expire after 60 seconds.

Redis

INCR user:123:requests
EXPIRE user:123:requests 60

Tracks API calls for clientA and resets the count every hour.

Redis

INCR api:clientA:limit
EXPIRE api:clientA:limit 3600

Sample Program

This design uses Redis to count user requests in a 60-second window. The first request sets the expiration. Each request increments the count. If the count goes above 5, the server blocks further requests until the count resets.

Redis

1. Client sends a request.
2. Server runs INCR on key 'user:42:requests'.
3. If the returned count is 1, server sets EXPIRE on the key for 60 seconds.
4. Server checks if count exceeds limit (e.g., 5 requests).
5. If limit exceeded, server rejects request; else, processes it.

Data flow:
- User request -> Server
- Server -> Redis INCR 'user:42:requests'
- Redis returns count
- Server -> Redis EXPIRE 'user:42:requests' 60 (only if count == 1)
- Server decides to allow or block request based on count
- Server responds to user

Important Notes

Always set EXPIRE only when the count is 1 to avoid resetting the TTL on every request.

This method works well for simple fixed-window rate limiting but may cause bursts at window edges.

For more precise control, consider sliding window or token bucket algorithms.

Summary

Use INCR to count actions and EXPIRE to reset counts automatically.

Set EXPIRE only once when the count starts to avoid TTL reset issues.

This approach is simple, fast, and suitable for many rate limiting needs.

Practice

1. What is the main purpose of using the INCR command in a Redis rate limiter?

easy

A. To increase the count of actions performed by a user

B. To set the expiration time for a key

C. To delete a key from Redis

D. To reset the count to zero

Solution

1. Step 1: Understand the role of INCR in counting

   The INCR command increments the integer value stored at a key by one, which is used to count user actions.

2. Step 2: Differentiate from other commands

   Commands like EXPIRE set timeouts, and DEL deletes keys, but INCR specifically increases counts.

3. Final Answer:

   To increase the count of actions performed by a user -> Option A

4. Quick Check:

   INCR counts actions = A [OK]

Hint: INCR always adds 1 to a key's value [OK]

Common Mistakes:

• Confusing INCR with EXPIRE
• Thinking INCR resets counts
• Assuming INCR deletes keys

2. Which Redis command syntax correctly sets a key to expire after 60 seconds?

easy

A. EXPIRE key '60s'

B. EXPIRE 60 key

C. EXPIRE key 60

D. SETEX key 60 value

Solution

1. Step 1: Recall EXPIRE command syntax

   The correct syntax is EXPIRE key seconds, where seconds is an integer.

2. Step 2: Evaluate options

   EXPIRE key 60 matches the syntax. EXPIRE 60 key reverses arguments. SETEX key 60 value is a different command combining SET and EXPIRE. EXPIRE key '60s' uses invalid string format for seconds.

3. Final Answer:

   EXPIRE key 60 -> Option C

4. Quick Check:

   EXPIRE key seconds = D [OK]

Hint: EXPIRE command uses key then seconds [OK]

Common Mistakes:

• Swapping key and seconds arguments
• Using string with units for seconds
• Confusing SETEX with EXPIRE

3. Given the following Redis commands executed in order:

INCR user:123
EXPIRE user:123 10
INCR user:123
TTL user:123

What will the TTL user:123 command return immediately after these commands?

medium

A. 10

B. 9 or less

C. -1

D. 0

Solution

1. Step 1: Analyze command sequence

   First INCR creates or increments the key. Then EXPIRE sets TTL to 10 seconds. Another INCR increments the count but does not reset TTL.

2. Step 2: Understand TTL behavior

   TTL counts down from 10 seconds after EXPIRE. The second INCR does not affect TTL, so TTL will be less than or equal to 9 seconds depending on execution time.

3. Final Answer:

   9 or less -> Option B

4. Quick Check:

   TTL after EXPIRE and INCR = B [OK]

Hint: INCR does not reset TTL, so TTL decreases over time [OK]

Common Mistakes:

• Assuming INCR resets TTL
• Expecting TTL to remain exactly 10
• Confusing TTL -1 (no expire) with positive TTL

4. You implemented a rate limiter using INCR and EXPIRE, but the count never resets after the expiration time. What is the most likely cause?

medium

A. The key was deleted manually before expiration

B. INCR command resets the TTL unintentionally

C. Redis server is out of memory

D. EXPIRE was never set on the key

Solution

1. Step 1: Identify why count doesn't reset

   If the count never resets, it means the key never expired, so the expiration was not set properly.

2. Step 2: Evaluate other options

   INCR does not reset TTL, manual deletion would remove the key, and out of memory causes errors but not this behavior.

3. Final Answer:

   EXPIRE was never set on the key -> Option D

4. Quick Check:

   No EXPIRE means no reset = C [OK]

Hint: Always set EXPIRE once to enable automatic reset [OK]

Common Mistakes:

• Assuming INCR resets TTL
• Ignoring that EXPIRE must be set
• Blaming Redis memory issues incorrectly

5. You want to implement a rate limiter that allows 100 requests per user per minute using Redis with INCR and EXPIRE. Which approach is best to avoid resetting the expiration time on every request?

hard

A. Set EXPIRE only when INCR returns 1

B. Call EXPIRE every time after INCR

C. Use SETEX instead of INCR

D. Delete the key manually after 60 seconds

Solution

1. Step 1: Understand TTL reset problem

   Calling EXPIRE every time resets TTL, causing the window to slide indefinitely, which is incorrect for fixed window rate limiting.

2. Step 2: Best practice for setting EXPIRE

   Set EXPIRE only when the key is created (when INCR returns 1), so TTL counts down properly without resetting.

3. Final Answer:

   Set EXPIRE only when INCR returns 1 -> Option A

4. Quick Check:

   Set EXPIRE once at first INCR = A [OK]

Hint: Set EXPIRE only on first INCR to avoid TTL reset [OK]

Common Mistakes:

• Resetting EXPIRE on every request
• Using SETEX which overwrites count
• Manually deleting keys instead of TTL