Rate limiting with throttler in NestJS - Mini Project: Build & Apply

Rate limiting with throttler

📖 Scenario: You are building a simple NestJS API that needs to protect its endpoints from too many requests in a short time. This helps keep the server stable and fair for all users.

🎯 Goal: Build a NestJS controller with rate limiting using the @nestjs/throttler package. You will set up the data, configure the rate limit, apply the throttler to an endpoint, and complete the setup so the API limits requests properly.

📋 What You'll Learn

Create a NestJS controller named AppController with a GET endpoint /hello that returns a greeting string.

Add a configuration variable ttl (time to live) set to 60 seconds for the rate limit window.

Use the @Throttle decorator to limit the /hello endpoint to 5 requests per ttl seconds.

Complete the module setup by importing ThrottlerModule with the ttl and limit values.

💡 Why This Matters

🌍 Real World

Rate limiting is used in real APIs to prevent abuse and keep services stable by limiting how often users can call endpoints.

💼 Career

Understanding how to implement rate limiting with NestJS and throttler is important for backend developers building scalable and secure APIs.

1

Create the controller with a simple GET endpoint

Create a NestJS controller class named AppController. Inside it, add a method getHello decorated with @Get('hello') that returns the string 'Hello, world!'.

NestJS

import { Controller, Get } from '@nestjs/common';

// Your code here

Hint

Use @Controller() to mark the class as a controller. Use @Get('hello') above the method that returns the greeting string.

2

Add a configuration variable for rate limit time window

Add a constant variable named ttl and set it to 60. This will represent the time window in seconds for rate limiting.

NestJS

import { Controller, Get } from '@nestjs/common';

const ttl = 60; // Time window in seconds

// Your code here

Hint

Declare const ttl = 60; at the top level before the controller class.

3

Apply the @Throttle decorator to limit requests

Import @Throttle from @nestjs/throttler. Add the decorator @Throttle(5, ttl) above the getHello method to limit it to 5 requests per 60 seconds.

NestJS

import { Controller, Get } from '@nestjs/common';
import { Throttle } from '@nestjs/throttler';

const ttl = 60;

@Controller()
export class AppController {
  @Get('hello')
  // Your code here
  getHello(): string {
    return 'Hello, world!';
  }
}

Hint

Use @Throttle(5, ttl) just above the getHello method.

4

Complete the module setup with ThrottlerModule import

Import ThrottlerModule from @nestjs/throttler. In your module file, add ThrottlerModule.forRoot({ ttl, limit: 5 }) to the imports array of the @Module decorator to enable global throttling.

NestJS

import { Module } from '@nestjs/common';
import { ThrottlerModule } from '@nestjs/throttler';
import { AppController } from './app.controller';

const ttl = 60;

@Module({
  imports: [
    // Your code here
  ],
  controllers: [AppController],
})
export class AppModule {}

Hint

Use ThrottlerModule.forRoot({ ttl, limit: 5 }) inside the imports array of @Module.

Practice

1. What is the main purpose of using the @Throttle(ttl, limit) decorator in a NestJS application?

easy

A. To limit how many requests a user can make in a given time

B. To increase the speed of API responses

C. To log all incoming requests for debugging

D. To automatically retry failed requests

Solution

1. Step 1: Understand the purpose of rate limiting

   Rate limiting is used to protect an app from too many requests in a short time.

2. Step 2: Role of @Throttle(ttl, limit)

   This decorator sets how many requests are allowed within a time window (ttl).

3. Final Answer:

   To limit how many requests a user can make in a given time -> Option A

4. Quick Check:

   Rate limiting = request limit [OK]

Hint: Throttle controls request count per time window [OK]

Common Mistakes:

• Confusing throttling with logging
• Thinking it speeds up responses
• Assuming it retries failed requests

2. Which of the following is the correct way to apply a rate limit of 10 requests per 60 seconds on a NestJS controller method?

easy

A. @Throttle(10, 60)

B. @Throttle(60, 10)

C. @Throttle(60)

D. @Throttle(limit=10, ttl=60)

Solution

1. Step 1: Understand @Throttle(ttl, limit) parameter order

   The first parameter is ttl (time to live in seconds), second is limit (max requests).

2. Step 2: Match parameters to desired limit

   For 10 requests per 60 seconds, ttl=60 and limit=10, so @Throttle(60, 10).

3. Final Answer:

   @Throttle(60, 10) -> Option B

4. Quick Check:

   ttl first, limit second = @Throttle(60, 10) [OK]

Hint: Remember: first ttl (seconds), then limit (count) [OK]

Common Mistakes:

• Swapping ttl and limit parameters
• Using named parameters which are unsupported
• Providing only one parameter

3. Given the following code snippet, what will happen if a user sends 6 requests within 10 seconds?

import { Controller, Get } from '@nestjs/common';
import { Throttle } from '@nestjs/throttler';

@Controller('api')
export class ApiController {
  @Get('data')
  @Throttle(10, 5)
  getData() {
    return 'Success';
  }
}

medium

A. First 5 requests return 'Success', 6th request is blocked

B. Only the 6th request returns 'Success'

C. All requests are blocked

D. All 6 requests return 'Success'

Solution

1. Step 1: Analyze the throttle settings

   @Throttle(10, 5) means 5 requests allowed per 10 seconds.

2. Step 2: Evaluate request count against limit

   6 requests exceed the limit by 1, so the 6th request is blocked.

3. Final Answer:

   First 5 requests return 'Success', 6th request is blocked -> Option A

4. Quick Check:

   Limit 5 per 10s, 6th blocked [OK]

Hint: Requests over limit get blocked after limit reached [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking limit is per request instead of per time window
• Confusing ttl and limit values

4. You added @Throttle(60, 10) to a controller method but it does not limit requests as expected. What is the most likely cause?

medium

A. The parameters are reversed; it should be @Throttle(10, 60)

B. The @Throttle decorator only works on services, not controllers

C. You forgot to import and configure ThrottlerModule in your app module

D. You need to restart the server after adding the decorator

Solution

1. Step 1: Check if ThrottlerModule is configured

   Throttling requires ThrottlerModule.forRoot() to be imported in the app module.

2. Step 2: Understand decorator usage and parameters

   The decorator works on controllers and methods; parameter order is correct as @Throttle(60, 10).

3. Final Answer:

   You forgot to import and configure ThrottlerModule in your app module -> Option C

4. Quick Check:

   Module config required for throttling [OK]

Hint: Always import ThrottlerModule to enable throttling [OK]

Common Mistakes:

• Assuming decorator works without module setup
• Swapping ttl and limit parameters
• Not restarting server after changes (usually needed but not main cause)

5. You want to apply a global rate limit of 100 requests per 60 seconds for your entire NestJS app, but allow a specific controller to have a higher limit of 200 requests per 60 seconds. How should you configure this using the throttler?

hard

A. Add @Throttle(100, 60) globally and @Throttle(200, 60) on the controller

B. Set ThrottlerModule.forRoot({ ttl: 200, limit: 60 }) globally and add @Throttle(100, 60) on the controller

C. Set ThrottlerModule.forRoot({ ttl: 100, limit: 60 }) globally and add @Throttle(200, 60) on the controller

D. Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller

Solution

1. Step 1: Configure global throttling in ThrottlerModule.forRoot()

   Global settings use { ttl: 60, limit: 100 } for 100 requests per 60 seconds.

2. Step 2: Override limit on specific controller with @Throttle(60, 200)

   The decorator parameters are @Throttle(ttl, limit), so 200 requests per 60 seconds overrides global limit.

3. Final Answer:

   Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller -> Option D

4. Quick Check:

   Global config + decorator override = Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller [OK]

Hint: Global config in module, override with decorator on controller [OK]

Common Mistakes:

• Swapping ttl and limit in decorator
• Misconfiguring global module parameters
• Trying to set global limits with decorators only