Rate limiting with express-rate-limit - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of rate limiting in an Express app?

Rate limiting helps protect your app by limiting how many requests a user can make in a set time. It stops overload and abuse, like too many requests from one user.

beginner

How do you add express-rate-limit middleware to an Express app?

You first install express-rate-limit, then import it. Create a limiter with options like max requests and window time. Use app.use() to apply it to routes.

beginner

What does the 'windowMs' option control in express-rate-limit?

It sets the time window in milliseconds for counting requests. For example, 60000 means requests are counted per minute.

beginner

What happens when a user exceeds the max number of requests in express-rate-limit?

The user gets a 429 status code (Too Many Requests) and a message telling them to slow down.

intermediate

How can you customize the message sent when rate limit is exceeded?

You can use the 'handler' option in express-rate-limit to define a custom function that sends your own message or response.

What package do you use to add rate limiting in an Express app?

A express-rate-limit

B express-session

C cors

D body-parser

express-rate-limit is the package designed to limit repeated requests to Express routes.

Which option sets the max number of requests allowed in express-rate-limit?

A windowMs

B max

C delayMs

D handler

'max' defines the maximum number of requests allowed during the time window.

What HTTP status code does express-rate-limit send when limit is exceeded?

A 403 Forbidden

B 401 Unauthorized

C 429 Too Many Requests

D 500 Internal Server Error

429 status code means the user sent too many requests in a given time.

How do you apply rate limiting to all routes in an Express app?

A Use app.use() with the limiter middleware

B Add limiter inside each route handler

C Set limiter in package.json

D Use a global variable

app.use(limiter) applies the rate limiter middleware to all routes.

Which option lets you customize the response when rate limit is hit?

A skip

B windowMs

C max

D handler

'handler' is a function you provide to send a custom response when the limit is exceeded.

Explain how to set up express-rate-limit in a new Express app to limit requests to 100 per 15 minutes.

Think about the steps from installing to applying middleware.

Describe what happens when a user sends too many requests and how express-rate-limit handles it.

Focus on the user experience and server response.

Practice

1. What is the main purpose of using express-rate-limit in an Express app?

easy

A. To handle database connections efficiently

B. To speed up the server response time

C. To automatically restart the server on code changes

D. To limit the number of requests a user can make in a time window

Solution

1. Step 1: Understand the purpose of rate limiting

   Rate limiting is used to protect the server by restricting how many requests a user can send in a short time.

2. Step 2: Identify what express-rate-limit does

   This package helps set these limits easily in Express apps.

3. Final Answer:

   To limit the number of requests a user can make in a time window -> Option D

4. Quick Check:

   Rate limiting = limit requests [OK]

Hint: Rate limiting controls request count per time window [OK]

Common Mistakes:

• Thinking it speeds up server responses
• Confusing it with server restart tools
• Assuming it manages database connections

2. Which of the following is the correct way to import and use express-rate-limit in an Express app?

easy

A. const rateLimit = require('express-rate-limit'); app.use(rateLimit({ windowMs: 60000, max: 5 }));

B. const rateLimit = require('express-rate-limit'); app.use(rateLimit());

C. import rateLimit from 'express-rate-limit'; app.use(rateLimit());

D. import rateLimit from 'express-rate-limit'; app.use(rateLimit);

Solution

1. Step 1: Check import style for CommonJS

   Using require is correct for many Express apps.

2. Step 2: Verify usage of rateLimit function with options

   We must call rateLimit with an options object like { windowMs: 60000, max: 5 } to set limits.

3. Final Answer:

   const rateLimit = require('express-rate-limit'); app.use(rateLimit({ windowMs: 60000, max: 5 })); -> Option A

4. Quick Check:

   Import + call with options = B [OK]

Hint: Call rateLimit with options object, not empty or missing [OK]

Common Mistakes:

• Forgetting to call rateLimit as a function
• Using import without proper setup
• Passing rateLimit directly without options

3. Given this code snippet, what will happen if a user sends 7 requests within 1 minute?

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ windowMs: 60000, max: 5 });
app.use(limiter);

medium

A. All 7 requests will be accepted without any limit

B. Only the first 2 requests will be accepted; the rest will be blocked

C. Only the first 5 requests will be accepted; the next 2 will be blocked

D. The server will crash after 5 requests

Solution

1. Step 1: Understand the max and windowMs settings

   The limit is 5 requests per 60000 milliseconds (1 minute).

2. Step 2: Analyze the request count

   The first 5 requests are allowed; requests 6 and 7 exceed the limit and get blocked.

3. Final Answer:

   Only the first 5 requests will be accepted; the next 2 will be blocked -> Option C

4. Quick Check:

   max 5 requests = C [OK]

Hint: Requests over max in windowMs get blocked [OK]

Common Mistakes:

• Assuming all requests pass without limit
• Thinking limit resets before 1 minute
• Believing server crashes on limit

4. Identify the error in this code snippet for rate limiting:

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({ max: 10 });
app.use(limiter);

medium

A. Incorrect import statement for express-rate-limit

B. Missing windowMs option to define the time window

C. Using max instead of limit option

D. Calling app.use before defining limiter

Solution

1. Step 1: Check required options for rateLimit

   The windowMs option is needed to specify the time frame for the limit.

2. Step 2: Identify missing option

   The code only sets max but does not set windowMs, so the time window is undefined.

3. Final Answer:

   Missing windowMs option to define the time window -> Option B

4. Quick Check:

   windowMs missing = A [OK]

Hint: Always set windowMs with max for rateLimit [OK]

Common Mistakes:

• Forgetting windowMs causes no time limit
• Confusing max with limit option
• Wrong import syntax

5. You want to apply rate limiting only to the login route to prevent brute force attacks. Which code snippet correctly applies express-rate-limit only to /login?

hard

A. app.use('/login', rateLimit({ windowMs: 60000, max: 5 }));

B. app.use(rateLimit({ windowMs: 60000, max: 5 })); app.use('/login');

C. app.get('/login', rateLimit({ windowMs: 60000, max: 5 }));

D. app.post(rateLimit({ windowMs: 60000, max: 5 }), '/login');

Solution

1. Step 1: Understand how to apply middleware to specific routes

   Using app.use('/login', middleware) applies the middleware only to the /login path.

2. Step 2: Check the correct syntax for rateLimit middleware

   Calling rateLimit with options returns middleware to pass to app.use.

3. Final Answer:

   app.use('/login', rateLimit({ windowMs: 60000, max: 5 })); -> Option A

4. Quick Check:

   Middleware on route = A [OK]

Hint: Use app.use with path and rateLimit middleware [OK]

Common Mistakes:

• Calling app.use without path for specific routes
• Using app.get or app.post incorrectly with middleware
• Passing middleware after route string