Rate limiting with express-rate-limit - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when the rate limit is exceeded?

Consider this Express app using express-rate-limit:

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 3 });
app.use(limiter);
app.get('/', (req, res) => res.send('Hello'));

What response will the client receive after making 4 requests within one minute?

Express

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 3 });
app.use(limiter);
app.get('/', (req, res) => res.send('Hello'));

A The 4th request returns status 429 with message 'Too many requests, please try again later.'

B The 4th request returns status 200 with 'Hello' as usual.

C The 4th request returns status 500 due to server error.

D The 4th request is queued and delayed until the window resets.

💡 Hint

Think about what max and windowMs control in rate limiting.

The max option limits the number of requests per windowMs. After 3 requests, the 4th triggers a 429 status with a default message.

📝 Syntax

intermediate

Identify the syntax error in this rate limiter setup

Which option contains a syntax error when creating a rate limiter with express-rate-limit?

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });
app.use(limiter);

Express

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });
app.use(limiter);

A const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });

B const limiter = rateLimit({ windowMs: '15m', max: 100 });

C const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: '100' });

D const limiter = rateLimit({ windowMs: 15 * 60 * 1000 max: 100 });

💡 Hint

Look carefully at the object syntax inside the parentheses.

Option D is missing a comma between windowMs and max, causing a syntax error.

❓ state_output

advanced

What is the value of the 'X-RateLimit-Remaining' header after 2 requests?

Given this rate limiter:

const limiter = rateLimit({ windowMs: 60000, max: 5 });
app.use(limiter);

After a client makes 2 requests within the window, what will the X-RateLimit-Remaining header value be in the response?

Express

const limiter = rateLimit({ windowMs: 60000, max: 5 });
app.use(limiter);

A '5'

B '2'

C '3'

D '0'

💡 Hint

Remember the header shows how many requests remain before limit is hit.

With max 5, after 2 requests, 3 remain, so the header is '3'.

🔧 Debug

advanced

Why does this rate limiter not block requests as expected?

Consider this code snippet:

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 2 });
app.get('/api', limiter, (req, res) => res.send('OK'));
app.get('/api', (req, res) => res.send('Fallback'));

Why might the rate limiter not block requests after 2 hits?

Express

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 2 });
app.get('/api', limiter, (req, res) => res.send('OK'));
app.get('/api', (req, res) => res.send('Fallback'));

A The limiter is not applied because max is too low.

B The second route for '/api' overrides the first, bypassing the limiter.

C The limiter middleware is missing next() call.

D The windowMs value is too short to trigger blocking.

💡 Hint

Think about how Express matches routes in order.

Express matches routes in order. The second app.get('/api') overrides the first, so the limiter middleware is never called.

🧠 Conceptual

expert

How to implement different rate limits per route using express-rate-limit?

You want to apply a strict rate limit on /login (max 5 requests per 10 minutes) and a looser limit on /api (max 100 requests per 15 minutes). Which setup correctly achieves this?

A Create two limiters with different configs and apply each to its route separately.

B Create one limiter with max 5 and apply it globally to all routes.

C Create two limiters but apply only one to all routes.

D Create one limiter with max 100 and apply it globally to all routes.

💡 Hint

Think about how middleware can be applied per route.

To have different limits per route, create separate limiter instances with their own configs and apply them to the specific routes.

Practice

1. What is the main purpose of using express-rate-limit in an Express app?

easy

A. To handle database connections efficiently

B. To speed up the server response time

C. To automatically restart the server on code changes

D. To limit the number of requests a user can make in a time window

Solution

1. Step 1: Understand the purpose of rate limiting

   Rate limiting is used to protect the server by restricting how many requests a user can send in a short time.

2. Step 2: Identify what express-rate-limit does

   This package helps set these limits easily in Express apps.

3. Final Answer:

   To limit the number of requests a user can make in a time window -> Option D

4. Quick Check:

   Rate limiting = limit requests [OK]

Hint: Rate limiting controls request count per time window [OK]

Common Mistakes:

• Thinking it speeds up server responses
• Confusing it with server restart tools
• Assuming it manages database connections

2. Which of the following is the correct way to import and use express-rate-limit in an Express app?

easy

A. const rateLimit = require('express-rate-limit'); app.use(rateLimit({ windowMs: 60000, max: 5 }));

B. const rateLimit = require('express-rate-limit'); app.use(rateLimit());

C. import rateLimit from 'express-rate-limit'; app.use(rateLimit());

D. import rateLimit from 'express-rate-limit'; app.use(rateLimit);

Solution

1. Step 1: Check import style for CommonJS

   Using require is correct for many Express apps.

2. Step 2: Verify usage of rateLimit function with options

   We must call rateLimit with an options object like { windowMs: 60000, max: 5 } to set limits.

3. Final Answer:

   const rateLimit = require('express-rate-limit'); app.use(rateLimit({ windowMs: 60000, max: 5 })); -> Option A

4. Quick Check:

   Import + call with options = B [OK]

Hint: Call rateLimit with options object, not empty or missing [OK]

Common Mistakes:

• Forgetting to call rateLimit as a function
• Using import without proper setup
• Passing rateLimit directly without options

3. Given this code snippet, what will happen if a user sends 7 requests within 1 minute?

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 5 });
app.use(limiter);

medium

A. All 7 requests will be accepted without any limit

B. Only the first 2 requests will be accepted; the rest will be blocked

C. Only the first 5 requests will be accepted; the next 2 will be blocked

D. The server will crash after 5 requests

Solution

1. Step 1: Understand the max and windowMs settings

   The limit is 5 requests per 60000 milliseconds (1 minute).

2. Step 2: Analyze the request count

   The first 5 requests are allowed; requests 6 and 7 exceed the limit and get blocked.

3. Final Answer:

   Only the first 5 requests will be accepted; the next 2 will be blocked -> Option C

4. Quick Check:

   max 5 requests = C [OK]

Hint: Requests over max in windowMs get blocked [OK]

Common Mistakes:

• Assuming all requests pass without limit
• Thinking limit resets before 1 minute
• Believing server crashes on limit

4. Identify the error in this code snippet for rate limiting:

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ max: 10 });
app.use(limiter);

medium

A. Incorrect import statement for express-rate-limit

B. Missing windowMs option to define the time window

C. Using max instead of limit option

D. Calling app.use before defining limiter

Solution

1. Step 1: Check required options for rateLimit

   The windowMs option is needed to specify the time frame for the limit.

2. Step 2: Identify missing option

   The code only sets max but does not set windowMs, so the time window is undefined.

3. Final Answer:

   Missing windowMs option to define the time window -> Option B

4. Quick Check:

   windowMs missing = A [OK]

Hint: Always set windowMs with max for rateLimit [OK]

Common Mistakes:

• Forgetting windowMs causes no time limit
• Confusing max with limit option
• Wrong import syntax

5. You want to apply rate limiting only to the login route to prevent brute force attacks. Which code snippet correctly applies express-rate-limit only to /login?

hard

A. app.use('/login', rateLimit({ windowMs: 60000, max: 5 }));

B. app.use(rateLimit({ windowMs: 60000, max: 5 })); app.use('/login');

C. app.get('/login', rateLimit({ windowMs: 60000, max: 5 }));

D. app.post(rateLimit({ windowMs: 60000, max: 5 }), '/login');

Solution

1. Step 1: Understand how to apply middleware to specific routes

   Using app.use('/login', middleware) applies the middleware only to the /login path.

2. Step 2: Check the correct syntax for rateLimit middleware

   Calling rateLimit with options returns middleware to pass to app.use.

3. Final Answer:

   app.use('/login', rateLimit({ windowMs: 60000, max: 5 })); -> Option A

4. Quick Check:

   Middleware on route = A [OK]

Hint: Use app.use with path and rateLimit middleware [OK]

Common Mistakes:

• Calling app.use without path for specific routes
• Using app.get or app.post incorrectly with middleware
• Passing middleware after route string