Limit: 10 a minute. 50 servers let all 100 through.

transcript

The limit is 10 requests a minute. The user sends 100. All 100 get through. And every server did exactly what it was told.

Each of your 50 servers counts in its own memory. Limit: 10. The load balancer spreads the 100 around. Server 1 sees 2. Under 10. Allow. Server 2 sees 3. Allow. Every server sees a tiny slice. Total allowed: 100. Ten times the limit.

The fix: one counter, shared. All 50 servers increment the same key in Redis. But check-then-update is two steps. Fifty servers racing can slip between them. So it runs as a Lua script inside Redis. Read, refill, spend, write. One atomic step. Out comes a single answer. Allow, or deny.

It costs a round trip on every request. About 1 to 2 milliseconds. And a new dependency. If Redis goes down, what happens? That's the next fight.

Servers counting alone can let a user through many times over. A limit only means something if someone sees the whole count.

Full breakdown in the lecture.