Rate limiting with throttler in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user exceeds the rate limit in NestJS Throttler?

Consider a NestJS controller using the ThrottlerGuard with a limit of 5 requests per 10 seconds. What is the expected behavior when a user sends the 6th request within 10 seconds?

NestJS

import { Controller, Get, UseGuards } from '@nestjs/common';
import { ThrottlerGuard, Throttle } from '@nestjs/throttler';

@Controller('test')
@UseGuards(ThrottlerGuard)
export class TestController {
  @Get()
  @Throttle(5, 10)
  getTest() {
    return 'Success';
  }
}

A The server crashes due to exceeding the request limit.

B The 6th request is blocked and the server responds with HTTP 429 Too Many Requests error.

C The 6th request is accepted and returns 'Success' like the previous requests.

D The 6th request is delayed by 10 seconds before responding with 'Success'.

💡 Hint

Think about what HTTP status code is standard for rate limiting.

NestJS ThrottlerGuard automatically blocks requests exceeding the limit and returns HTTP 429 status code to indicate too many requests.

📝 Syntax

intermediate

Which option correctly applies a global rate limit of 10 requests per minute using NestJS Throttler?

You want to set a global rate limit of 10 requests per 60 seconds for all routes in your NestJS app. Which code snippet correctly configures this?

A

app.useGlobalGuards(app.get(ThrottlerGuard));
// and in module imports: ThrottlerModule.forRoot({ ttl: 60, limit: 10 })

B app.useGlobalGuards(Throttle({ limit: 10, ttl: 60 }));

C

app.useGlobalGuards(new ThrottlerGuard());
app.use(Throttle({ limit: 10, ttl: 60 }));

D app.useGlobalGuards(new ThrottlerGuard({ limit: 10, ttl: 60 }));

💡 Hint

Remember that ThrottlerModule.forRoot sets global config and ThrottlerGuard is applied globally.

The correct way is to import ThrottlerModule with config and apply ThrottlerGuard globally via app.useGlobalGuards with the guard instance from the app context.

🔧 Debug

advanced

Why does the custom rate limit decorator not work as expected?

You wrote a custom decorator to apply a rate limit of 3 requests per 5 seconds on a controller method, but the limit is not enforced. What is the likely cause?

NestJS

import { SetMetadata } from '@nestjs/common';

export const CustomThrottle = () => SetMetadata('throttle', { limit: 3, ttl: 5 });

// Usage:
@CustomThrottle()
@Get()
getData() {
  return 'data';
}

A The limit and ttl values must be strings, not numbers.

B The custom decorator syntax is invalid and causes a runtime error.

C The controller method must be decorated with @Throttle instead of a custom decorator.

D The ThrottlerGuard does not read the 'throttle' metadata key; it expects 'throttle' to be set via @Throttle decorator.

💡 Hint

Check what metadata key the official @Throttle decorator sets.

NestJS ThrottlerGuard looks for metadata key 'throttle' set by the official @Throttle decorator. Custom decorators must set the same key and format or extend the guard to read custom keys.

❓ state_output

advanced

What is the value of remaining requests after 2 calls in 10 seconds with limit 5?

Given a NestJS controller method with @Throttle(5, 10), after a user makes 2 successful calls within 10 seconds, what is the value of the 'X-RateLimit-Remaining' header in the response of the 2nd call?

NestJS

import { Controller, Get, UseGuards } from '@nestjs/common';
import { ThrottlerGuard, Throttle } from '@nestjs/throttler';

@Controller('api')
@UseGuards(ThrottlerGuard)
export class ApiController {
  @Get('data')
  @Throttle(5, 10)
  getData() {
    return 'ok';
  }
}

A 5

B 3

C 4

D 2

💡 Hint

The header counts how many requests remain after the current one.

The limit is 5 requests per 10 seconds. After 2 calls, 3 remain. But the header shows remaining after the current request, so after the 2nd call, 4 remain.

🧠 Conceptual

expert

How does NestJS Throttler handle distributed rate limiting in a multi-instance setup?

In a production environment with multiple NestJS app instances behind a load balancer, how does the ThrottlerModule ensure consistent rate limiting across all instances?

A It uses an external shared store like Redis to keep request counts synchronized across instances.

B Each instance tracks requests independently, so limits apply per instance, not globally.

C It uses in-memory storage with periodic synchronization between instances automatically.

D It disables rate limiting automatically when multiple instances are detected.

💡 Hint

Think about how to share state across servers in a cluster.

NestJS Throttler supports using external stores like Redis to share request counts, enabling consistent rate limiting across multiple app instances.