Rate limiting you can trip yourself

Kong Course · lesson 7 of 15 · 5 min read

Press Send six times and watch the sixth one fail - that is the lesson.

Open this lesson in the learning hub

Key points

  • Rate limiting protects your upstream from one noisy caller taking everything down.
  • Kong counts per consumer when it knows one, and per IP when it does not.
  • Rejected requests are stopped at the gateway, so the cost of an overload never reaches your service.
  • The local policy counts per Kong node and is fast; redis counts cluster-wide and is exact.
  • Kong returns 429 plus headers telling the caller how much quota is left.

Example

plugins:
  - name: rate-limiting
    route: orders-api
    config:
      minute: 5
      policy: local          # per node; use redis for a cluster-wide count
      limit_by: consumer

Rate limiting rejects the overflow at the gateway, so your upstream only ever sees traffic it can handle.

Consumers and API keys Choosing an auth plugin

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the Kong Course course, and every lesson in it is listed on the Kong Course contents page.