What you need to know
A rate limit can reduce abuse, accidental retry loops, and sudden resource spikes. A single limit for every route may be too strict for ordinary browsing or too lenient for costly actions.
How to apply it
Choose limits by route and identity, return 429 with a retry hint where appropriate, and monitor legitimate traffic before tightening rules. Use shared storage when the app runs on multiple instances.
Common mistake to avoid
Do not treat an IP address as a perfect user identity. Shared networks and mobile carriers can make many real people appear under one address.