Rate limiting with express-rate-limit - Step-by-Step Execution

Concept Flow - Rate limiting with express-rate-limit

Client sends request

↓

express-rate-limit middleware

↓

Check request count for IP

↓

Send 429

When a client sends a request, the middleware checks how many requests that IP made. If the limit is exceeded, it sends a 429 error. Otherwise, it lets the request continue.

Execution Sample

Express

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 3
});

app.use(limiter);

This code limits each IP to 3 requests per 60 seconds using express-rate-limit middleware.

Execution Table

Step	Request Number	IP Request Count	Condition (count > max?)	Action	Response
1	1	1	1 > 3? No	Allow request	200 OK
2	2	2	2 > 3? No	Allow request	200 OK
3	3	3	3 > 3? No	Allow request	200 OK
4	4	4	4 > 3? Yes	Block request	429 Too Many Requests

💡 At step 4, the request count exceeds max (4 > 3), so the request is blocked with 429.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4
IP Request Count	0	1	2	3	4

Key Moments - 2 Insights

Why does the 4th request get blocked even though the max is 3?

Because the middleware counts requests starting from 1, so when the count reaches 4, it exceeds the max of 3, triggering the block as shown in execution_table step 4.

Does the rate limit reset automatically?

Yes, after the windowMs time (60 seconds here), the count resets to 0, allowing new requests. This is implied by the windowMs setting in the code sample.

Visual Quiz - 3 Questions

Look at the execution table, what is the IP Request Count at step 3?

A 4

B 2

C 3

D 1

💡 Hint

Check the 'IP Request Count' column at step 3 in the execution_table.

At which request number does the condition become true and block the request?

A 4

B 3

C 2

D 1

💡 Hint

Look at the 'Condition' column in execution_table where it changes from No to Yes.

If max was changed to 5, what would happen at request number 4?

A Request 4 would be blocked

B Request 4 would be allowed

C Request 4 would cause an error

D Request 4 would reset the count

💡 Hint

Compare the 'max' value in the code sample and the condition logic in execution_table.

Concept Snapshot

express-rate-limit middleware limits requests per IP.
Set windowMs (time window) and max (max requests).
Middleware counts requests per IP.
If count > max, sends 429 error.
Otherwise, request proceeds normally.

Full Transcript

Rate limiting with express-rate-limit works by counting how many requests a client IP makes within a set time window. The middleware checks this count on each request. If the count exceeds the max allowed, it blocks the request with a 429 Too Many Requests response. Otherwise, it lets the request continue. The count resets after the time window expires. This helps protect servers from too many requests from one client.