Api Design medium
Your API uses a 'Fixed Window' rate limiter (100 req/min). A client sends 100 requests at 12:00:59 and 100 more at 12:01:01. What happens?
- A The first batch is rejected because the window resets on calendar minutes, but the second batch succeeds as it falls into a new processing window.
- B The rate limiter blocks the second batch entirely, as the client's global request count exceeded 100 in a rolling 60-second window across all periods.
- C Both batches succeed because they reside in different fixed calendar windows, but the server experiences a burst of 200 requests within a 2-second period.
- D The requests are automatically queued by the API Gateway and processed at a constant rate of 1.6 requests per second until the total burst is cleared.
Answer: C. Both batches succeed because they reside in different fixed calendar windows, but the server experiences a burst of 200 requests within a 2-second period.
A **Fixed Window** counter resets completely at the window boundary. If a client sends a full quota of requests at the end of one window (12:00:59) and another full quota at the start of the next (12:01:00), they effectively double their rate for that short period. This 'burst' issue is solved by Sliding Window logs or Token Bucket algorithms.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- You're designing a REST API for a blog. Which endpoint best represents 'get all comments for post 123'?
- A client wants to update only the 'status' field of an order, leaving other fields unchanged. Which HTTP method is most appropriate?
- A client calls POST /users with valid data, and the user is created. What status code should the server return?
- A client retries a failed 'POST /payments' request due to network timeout. The server receives the request twice. Without idempotency handling, what can happen?
- An API returns 10,000 products. Returning all in one response is impractical. Which pagination approach is simple and stateless?
- Your API serves both mobile apps and third-party integrations. Which authentication method is most appropriate?