4.3 Distributed Rate Limiting

Fifty application instances sit behind a load balancer, and each one keeps its own in-memory counter for the rule "100 API calls per minute per user". A client whose requests are spread across all fifty instances can then make 50 x 100 = 5,000 calls a minute without any single counter going over 100. A rate limiter caps how often a client may do something, such as 100 API calls per minute or 5 login attempts per hour. The arithmetic above shows why the count must live in shared state once there is more than one server.