High Rate limiting Question 198 of 226

How would you rate-limit OTP sends for an Indian login flow without locking out a shared NAT?

Java Specialist · Speak this in 60–90 seconds · Faridabad & Delhi NCR

PICTURE THIS: HOW TO EXPLAIN IT

IdeaRate limiting

HowWhat happens inside

Why they askShows real use

Simple meaning

Cap per phone number strictly, and cap per IP more loosely because offices and mobile NATs share addresses.

WHY — Rate limiting instead of guessing?

Why interviewers care about Rate limiting:

This is a process

question about Rate limiting.

Panels listen for order,

trade-offs, and what you would actually do on a Backend project - not buzzwords.

Stay structured

Name the idea, why it exists, then one short example.

Close cleanly

End with when you use it and one common pitfall.

STEPS — What happens step by step?

Before you speak the answer, walk the interviewer through these steps:

1
Cap per phone number
strictly, and cap per IP more loosely because offices and mobile NATs share addresses.
2
Use Redis sliding windows,
exponential backoff after failures, and never reveal whether a number is registered.
3
Couple this with device
signals so attackers cannot rotate IPs against one MSISDN.
4
Give an example
One tiny concrete case you can say aloud.
5
Common mistake
What juniors usually get wrong.
6
Close
When you pick this over the alternative.

EXAMPLE — See it in action

Here's a short line you can speak, broken into clear beats:

Say this line

“Use Redis sliding windows, exponential backoff after failures, and never reveal ”

Break into beats

UseRedisslidingwindowsexponentialbackoff

Speaking order

2987408337471632900

Note: Adapt this scaffold to your own project — keep it under 60–90 seconds.

Key takeaway

Cap per phone number strictly, and cap per IP more loosely because offices and mobile NATs share addresses. Use Redis sliding windows, exponential backoff after failures, and never reveal whether a number is registered.