Build a Rate Limiter

You build rate-limiting middleware that sits in front of an HTTP API and decides, per client key, whether each incoming request is allowed or rejected with 429 Too Many Requests. You implement at least two algorithms, token bucket and sliding-window log or counter, and back the counters in Redis so limits hold across multiple server instances. The middleware identifies callers by API key or IP, returns X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After headers, and stays correct under concurrent traffic. It is worth building because rate limiting is a real production concern at every API company and it teaches you distributed counters, atomicity, and the trade-offs between limiter algorithms. It is resume-worthy because it demonstrates you can reason about fairness, race conditions, and shared state across a cluster.