How do you implement rate limiting for WebSocket connections?

WebSocket rate limiting must occur at two levels: connection rate (new handshakes per IP/time) and message rate (messages per connection/time). (1) Connection rate limiting at the reverse proxy: NGINX limit_req_zone limits WebSocket upgrade requests per IP; (2) Message rate limiting on the server: implement a token bucket or sliding window algorithm per connection. In Node.js: const rateLimiter = new Map(); ws.on('message', () => { const now = Date.now(); const bucket = rateLimiter.get(ws); if (now - bucket.lastReset > 1000) { bucket.count = 0; bucket.lastReset = now; } if (++bucket.count > MAX_PER_SECOND) { ws.close(1008, 'Rate limit exceeded'); } }); (3) Distributed rate limiting — use Redis with sliding window counters (INCR user:rate:userid with TTL) to share rate limit state across multiple server instances; (4) Backpressure signaling — instead of closing connections, send a rate-limit message and temporarily pause processing to allow legitimate clients to recover.