Rate limiter with INCR and EXPIRE in Redis - Mini Project: Build & Apply

Rate limiter with INCR and EXPIRE

📖 Scenario: Your API is getting hammered by bots. You need to limit each user to 100 requests per minute using Redis. You'll build a rate limiter that uses INCR to count requests and EXPIRE to reset the window.

🎯 Goal: Build an atomic rate limiter using Redis INCR, EXPIRE, and a Lua script to prevent race conditions.

📋 What You'll Learn

Create a rate limit key for a user

Increment the counter and set expiry

Check if the user exceeded the limit

Make the operation atomic with a Lua script

💡 Why This Matters

🌍 Real World

Redis rate limiters protect APIs at companies like GitHub, Stripe, and Cloudflare from abuse and ensure fair usage across clients.

💼 Career

Backend engineers implement rate limiting in almost every production API to prevent abuse, manage costs, and ensure service stability.

1

Increment the rate limit counter

Use INCR to increment the key rate_limit:user:42. This creates the key with value 1 if it doesn't exist, or increments it if it does.

Redis

# Increment the rate limit counter for user 42
# Your code here

Hint

INCR creates the key with value 1 if it doesn't exist, or adds 1 to the current value.

2

Set the expiry window

Use EXPIRE to set a 60-second TTL on the key rate_limit:user:42 so the counter resets every minute.

Redis

INCR rate_limit:user:42

# Set 60-second expiry on the rate limit key
# Your code here

Hint

EXPIRE key seconds — sets the key to auto-delete after the given number of seconds.

3

Check if limit exceeded

Use GET to read the current count from rate_limit:user:42. In your application, you would compare this value against the limit of 100.

Redis

INCR rate_limit:user:42
EXPIRE rate_limit:user:42 60

# Get the current request count
# Your code here

Hint

GET returns the current value of the key as a string.

4

Make it atomic with Lua

Write an EVAL Lua script that: calls redis.call('INCR', KEYS[1]) and stores in local count, then if count == 1 calls redis.call('EXPIRE', KEYS[1], ARGV[1]), and returns count. Pass 1 key rate_limit:user:42 and 1 arg 60.

Redis

# Write an atomic Lua rate limiter with EVAL
# Your code here

Hint

EVAL runs a Lua script atomically. KEYS[1] is the first key argument, ARGV[1] is the first non-key argument.

Practice

1. What is the main purpose of using the INCR command in a Redis rate limiter?

easy

A. To increase the count of actions performed by a user

B. To set the expiration time for a key

C. To delete a key from Redis

D. To reset the count to zero

Solution

1. Step 1: Understand the role of INCR in counting

   The INCR command increments the integer value stored at a key by one, which is used to count user actions.

2. Step 2: Differentiate from other commands

   Commands like EXPIRE set timeouts, and DEL deletes keys, but INCR specifically increases counts.

3. Final Answer:

   To increase the count of actions performed by a user -> Option A

4. Quick Check:

   INCR counts actions = A [OK]

Hint: INCR always adds 1 to a key's value [OK]

Common Mistakes:

• Confusing INCR with EXPIRE
• Thinking INCR resets counts
• Assuming INCR deletes keys

2. Which Redis command syntax correctly sets a key to expire after 60 seconds?

easy

A. EXPIRE key '60s'

B. EXPIRE 60 key

C. EXPIRE key 60

D. SETEX key 60 value

Solution

1. Step 1: Recall EXPIRE command syntax

   The correct syntax is EXPIRE key seconds, where seconds is an integer.

2. Step 2: Evaluate options

   EXPIRE key 60 matches the syntax. EXPIRE 60 key reverses arguments. SETEX key 60 value is a different command combining SET and EXPIRE. EXPIRE key '60s' uses invalid string format for seconds.

3. Final Answer:

   EXPIRE key 60 -> Option C

4. Quick Check:

   EXPIRE key seconds = D [OK]

Hint: EXPIRE command uses key then seconds [OK]

Common Mistakes:

• Swapping key and seconds arguments
• Using string with units for seconds
• Confusing SETEX with EXPIRE

3. Given the following Redis commands executed in order:

INCR user:123
EXPIRE user:123 10
INCR user:123
TTL user:123

What will the TTL user:123 command return immediately after these commands?

medium

A. 10

B. 9 or less

C. -1

D. 0

Solution

1. Step 1: Analyze command sequence

   First INCR creates or increments the key. Then EXPIRE sets TTL to 10 seconds. Another INCR increments the count but does not reset TTL.

2. Step 2: Understand TTL behavior

   TTL counts down from 10 seconds after EXPIRE. The second INCR does not affect TTL, so TTL will be less than or equal to 9 seconds depending on execution time.

3. Final Answer:

   9 or less -> Option B

4. Quick Check:

   TTL after EXPIRE and INCR = B [OK]

Hint: INCR does not reset TTL, so TTL decreases over time [OK]

Common Mistakes:

• Assuming INCR resets TTL
• Expecting TTL to remain exactly 10
• Confusing TTL -1 (no expire) with positive TTL

4. You implemented a rate limiter using INCR and EXPIRE, but the count never resets after the expiration time. What is the most likely cause?

medium

A. The key was deleted manually before expiration

B. INCR command resets the TTL unintentionally

C. Redis server is out of memory

D. EXPIRE was never set on the key

Solution

1. Step 1: Identify why count doesn't reset

   If the count never resets, it means the key never expired, so the expiration was not set properly.

2. Step 2: Evaluate other options

   INCR does not reset TTL, manual deletion would remove the key, and out of memory causes errors but not this behavior.

3. Final Answer:

   EXPIRE was never set on the key -> Option D

4. Quick Check:

   No EXPIRE means no reset = C [OK]

Hint: Always set EXPIRE once to enable automatic reset [OK]

Common Mistakes:

• Assuming INCR resets TTL
• Ignoring that EXPIRE must be set
• Blaming Redis memory issues incorrectly

5. You want to implement a rate limiter that allows 100 requests per user per minute using Redis with INCR and EXPIRE. Which approach is best to avoid resetting the expiration time on every request?

hard

A. Set EXPIRE only when INCR returns 1

B. Call EXPIRE every time after INCR

C. Use SETEX instead of INCR

D. Delete the key manually after 60 seconds

Solution

1. Step 1: Understand TTL reset problem

   Calling EXPIRE every time resets TTL, causing the window to slide indefinitely, which is incorrect for fixed window rate limiting.

2. Step 2: Best practice for setting EXPIRE

   Set EXPIRE only when the key is created (when INCR returns 1), so TTL counts down properly without resetting.

3. Final Answer:

   Set EXPIRE only when INCR returns 1 -> Option A

4. Quick Check:

   Set EXPIRE once at first INCR = A [OK]

Hint: Set EXPIRE only on first INCR to avoid TTL reset [OK]

Common Mistakes:

• Resetting EXPIRE on every request
• Using SETEX which overwrites count
• Manually deleting keys instead of TTL