Api Design hard
You implement a Token Bucket rate limiter: bucket holds 100 tokens, refills 10 tokens/second. A client sends 100 requests instantly, then 10 req/sec. What happens?
- A The client successfully processes the initial 100 requests instantly from the bucket, and subsequent traffic is throttled to the exact refill rate of 10 requests per second.
- B All 100 requests are rejected immediately because the Token Bucket algorithm forbids any instantaneous burst that exceeds the long-term average refill rate of the system.
- C The bucket overflow mechanism triggers a temporary session-level ban, as the client's request velocity exceeded the predefined sustainable throughput for a single processing window.
- D The rate limiter automatically transitions the client to a 'Leaky Bucket' mode, where the requests are queued and processed at a constant rate of 1 request every 100 milliseconds.
Answer: A. The client successfully processes the initial 100 requests instantly from the bucket, and subsequent traffic is throttled to the exact refill rate of 10 requests per second.
The **Token Bucket** algorithm allows for short bursts of traffic up to the capacity of the bucket (the 'burst size'). Tokens are added at a constant rate (refill rate). If the bucket has tokens, requests are allowed immediately. This accommodates legitimate traffic spikes (like page loads) while enforcing a long-term average rate, unlike Leaky Bucket which forces a constant output rate.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- You're designing a REST API for a blog. Which endpoint best represents 'get all comments for post 123'?
- A client wants to update only the 'status' field of an order, leaving other fields unchanged. Which HTTP method is most appropriate?
- A client calls POST /users with valid data, and the user is created. What status code should the server return?
- A client retries a failed 'POST /payments' request due to network timeout. The server receives the request twice. Without idempotency handling, what can happen?
- An API returns 10,000 products. Returning all in one response is impractical. Which pagination approach is simple and stateless?
- Your API serves both mobile apps and third-party integrations. Which authentication method is most appropriate?