things no fullstack roadmap will ever teach you 🔥 (31/100) - Rate Limiting with Redis (Sliding Window) every backend dies the same way: one user decides to refresh 200 times per second. rate limiting is how you protect your api, not just from abuse, but from dumb bugs. most devs stop at “x requests per minute.” let’s fix that. 1. the problem basic counters (reqs/min) are easy but bursty. example → 100 reqs allowed/min. a user can still spam all 100 in the first second. 2. sliding window fix use timestamps instead of reset intervals. store each request timestamp in redis sorted set (ZADD). when a new req comes in: •remove timestamps older than 60s •count remaining •if count > limit → block pseudo logic: ZREMRANGEBYSCORE user:1 0 (now - 60) ZADD user:1 now 1 ZCARD user:1 this creates a true “60-second window” instead of a 1-minute bucket. 3. redis is perfect here it’s fast, atomic, and supports lua scripts to do all 3 ops in one call → zero race conditions. 4. why it scales no memory leaks (keys expire), constant-time ops, accurate throttling. works across multiple servers instantly (since redis = shared state). 5. real use cases • public apis (avoid ddos) • login endpoints (stop brute force) • internal admin panels (prevent loops or bug floods) 👉🏻mini project • build express middleware • store per-ip hits in redis sorted set • log blocked requests • visualize hits per user in a dashboard