عرض عملي: حدود لكل عميل عند الحافة

خطوة بخطوة

1. Add a Redis-backed request rate limiter filter at the gateway (Spring Cloud Gateway offers one; verify version and key resolver before recording).
2. Write a key resolver: authenticated customer id, falling back to IP.
3. Run a load test with an abusive client at 200 requests per second and a normal one at 5; show 429s only for the abusive one.
4. Planned mistake: run two gateway instances with an in-memory limiter; the abuser gets double the allowance. Fix: shared Redis limiter.
5. Add Retry-After and a clear JSON error body, and show a client script honoring it.