Inda kuma ta yaya kuke daidaita iyakance jerin bukatun (rate limiting)?

Question

Accepted Answer

Rate limiting yana dannewa da yawancin bukatun da client zai iya aiwatar da shi a lokacin. Kuna yi amfani da shi a **takaice da yawa** saboda kowannen wuri yana ganin wani abu daban, kuma kuna sanya shi akan **abin da ya kamata ya nuni wa wanda yake damun (abuser)**.

## Inda za a daidaita shi

- **Edge / CDN** — agogo na farko, kafin traffic ya kaiwa gare ku. Mafi rahusa a yi (wanda ke kai hari ba zai taɓa asalissiyar iyawa ba) amma sannu'a, galibi ana sanya shi akan IP.
- **Reverse proxy** (nginx, Envoy) — yana kagarar asalissiyar iyawa daga haɓakawar da ta wuce CDN, tare da kyakkyawan iko sopeka abubuwan zone da bursts.
- **Application layer** — mafi wahala na layer: yana san **mai amfani, API key, ko token**, don ya iya aiwatar da kayan shan koli na kwan-kwan-kwan kuma ya kagarar ayyuka masu tsada a kasua wanda proxy ba zai iya ganin ba.

## Ta yaya za a sanya shi da saka shi

- **Sanya shi akan** IP (wanda ba a san ba), API key (abokan ciniki), ko mai amfani da suka soja (adalacci per kwan).
- **Token bucket vs leaky bucket** — token bucket yana ba da izini ga **bursts** ta tara tokens, sannan yana zama dakin; leaky bucket yana daidaita zuwa auni mai tsaya. Mafi yawancin APIs suna so token bucket don ainihin bursts ba za a kubaita ba.
- **Zaba iyakance daga asali + kusan dangi** — auna ainihin bugi per client, sannan sanya cap a sauran gida don ainihin masu amfani ba za su taɓa iyaka ba.
- **Dawo da `429 Too Many Requests` tare da `Retry-After`** don clients su gudu a garunkuni a madaidaiciyar hanya maimakon fafussawa.

## Misali: nginx limit_req

```nginx
# Define a shared-memory zone keyed by client IP.
# rate=10r/s = the steady refill rate (token bucket).
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

server {
    location /api/ {
        # burst=20: allow a short spike of 20 queued requests
        # nodelay: serve the burst immediately instead of spacing it out
        limit_req zone=api burst=20 nodelay;

# Return 429 (not the default 503) so clients see a rate-limit signal
        limit_req_status 429;

proxy_pass http://backend;
    }
}
```

Han kowany IP yana kumawa a 10 bukatun/dakika, na iya bursts zuwa 20, kuma wani abu waje yana karbar `429`.

## Me ya sa aka buƙaci shi

Rate limiting shine mafi rahusa lissafi, yana bugun jiya kuma jiya na kagarowa akan Layer 7 haɓakawar, taimakawa barcilo, da gudu wanda ba a kudi sa. Jujuyan shi (edge don yawancin abubuwa, proxy don asalissiyar iyawa, app don shawara kasua) da sanya shi daidai yana dame wada yake damun yayin da ainihin masu amfani — kuma ainihin bursts — suka zo wajen sallama. Saitatin iyakance daga ainihin asali shi ne wanda yake kagarar shi daga zama wata hadari ta nata wajhe.