A rate limiter drops requests arriving at a rate exceeding a limit.
A rate shaper slows down processing rate to avoid exceeding the desired maximum rate. As it doesn't drop requests, there is a risk of queue overflow.
The optimal choice between the two depends on the type of application and the desired kind of protection.
EDIT: A combination of the two would probably be better.
A rate limiter drops requests arriving at a rate exceeding a limit.
A rate shaper slows down processing rate to avoid exceeding the desired maximum rate. As it doesn't drop requests, there is a risk of queue overflow.
The optimal choice between the two depends on the type of application and the desired kind of protection.
EDIT: A combination of the two would probably be better.