Rate limiting with express-rate-limit - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when the rate limit is exceeded?

Consider this Express app using express-rate-limit:

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 3 });
app.use(limiter);
app.get('/', (req, res) => res.send('Hello'));

What response will the client receive after making 4 requests within one minute?

Express

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 3 });
app.use(limiter);
app.get('/', (req, res) => res.send('Hello'));

A The 4th request returns status 429 with message 'Too many requests, please try again later.'

B The 4th request returns status 200 with 'Hello' as usual.

C The 4th request returns status 500 due to server error.

D The 4th request is queued and delayed until the window resets.

💡 Hint

Think about what max and windowMs control in rate limiting.

The max option limits the number of requests per windowMs. After 3 requests, the 4th triggers a 429 status with a default message.

📝 Syntax

intermediate

Identify the syntax error in this rate limiter setup

Which option contains a syntax error when creating a rate limiter with express-rate-limit?

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });
app.use(limiter);

Express

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });
app.use(limiter);

A const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });

B const limiter = rateLimit({ windowMs: '15m', max: 100 });

C const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: '100' });

D const limiter = rateLimit({ windowMs: 15 * 60 * 1000 max: 100 });

💡 Hint

Look carefully at the object syntax inside the parentheses.

Option D is missing a comma between windowMs and max, causing a syntax error.

❓ state_output

advanced

What is the value of the 'X-RateLimit-Remaining' header after 2 requests?

Given this rate limiter:

const limiter = rateLimit({ windowMs: 60000, max: 5 });
app.use(limiter);

After a client makes 2 requests within the window, what will the X-RateLimit-Remaining header value be in the response?

Express

const limiter = rateLimit({ windowMs: 60000, max: 5 });
app.use(limiter);

A '5'

B '2'

C '3'

D '0'

💡 Hint

Remember the header shows how many requests remain before limit is hit.

With max 5, after 2 requests, 3 remain, so the header is '3'.

🔧 Debug

advanced

Why does this rate limiter not block requests as expected?

Consider this code snippet:

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 2 });
app.get('/api', limiter, (req, res) => res.send('OK'));
app.get('/api', (req, res) => res.send('Fallback'));

Why might the rate limiter not block requests after 2 hits?

Express

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 2 });
app.get('/api', limiter, (req, res) => res.send('OK'));
app.get('/api', (req, res) => res.send('Fallback'));

A The limiter is not applied because max is too low.

B The second route for '/api' overrides the first, bypassing the limiter.

C The limiter middleware is missing next() call.

D The windowMs value is too short to trigger blocking.

💡 Hint

Think about how Express matches routes in order.

Express matches routes in order. The second app.get('/api') overrides the first, so the limiter middleware is never called.

🧠 Conceptual

expert

How to implement different rate limits per route using express-rate-limit?

You want to apply a strict rate limit on /login (max 5 requests per 10 minutes) and a looser limit on /api (max 100 requests per 15 minutes). Which setup correctly achieves this?

A Create two limiters with different configs and apply each to its route separately.

B Create one limiter with max 5 and apply it globally to all routes.

C Create two limiters but apply only one to all routes.

D Create one limiter with max 100 and apply it globally to all routes.

💡 Hint

Think about how middleware can be applied per route.

To have different limits per route, create separate limiter instances with their own configs and apply them to the specific routes.