Problem Statement
Where do you enforce limits: at the edge (gateway/CDN) or in the app? Explain the split.
Explanation
Put coarse, cheap checks at the edge to drop obvious abuse close to the user and save bandwidth. Enforce authenticated, precise quotas in the app or gateway where identity is known. Use shared keys and bloom filters to communicate hot offenders to edges quickly.
Keep the source of truth in one control plane to prevent drift. Propagate policy and counters via quick, eventually consistent channels with periodic reconciliation.
Code Solution
SolutionRead Only
Edge: IP burst shield; App: per-key token bucket + daily quota
