Rate limiting with throttler in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of rate limiting in web applications?

Rate limiting helps control how many requests a user or client can make in a certain time. It protects servers from overload and stops abuse like spamming or attacks.

beginner

In NestJS, which package is commonly used to implement rate limiting?

The @nestjs/throttler package is used to add rate limiting easily in NestJS applications.

intermediate

How do you apply rate limiting globally in a NestJS app using Throttler?

You import ThrottlerModule in your root module with settings like ttl (time to live) and limit (max requests). Then add ThrottlerGuard as a global guard to enforce limits on all routes.

beginner

What does the 'ttl' option mean in ThrottlerModule configuration?

'ttl' stands for time to live. It sets the time window in seconds during which the request count is tracked for rate limiting.

intermediate

How can you customize rate limits for specific routes in NestJS with Throttler?

You use the @Throttle(limit, ttl) decorator on controllers or methods to set custom limits per route, overriding global settings.

What does the 'limit' option in ThrottlerModule specify?

A Maximum number of requests allowed in the ttl window

B Time in seconds to wait before next request

C Number of users allowed to access the app

D Size of the request payload

The 'limit' sets how many requests a client can make within the ttl time window.

Which decorator is used to set rate limits on a specific route in NestJS?

A @Throttle()

B @RateLimit()

C @Limit()

D @Guard()

The @Throttle() decorator sets custom rate limits on controllers or methods.

What happens when a client exceeds the rate limit in NestJS Throttler?

A The server crashes

B The request is blocked and a 429 Too Many Requests error is returned

C The request is queued for later

D The client is logged out automatically

Exceeding the limit returns a 429 error to inform the client to slow down.

How do you enable ThrottlerGuard globally in a NestJS app?

A Set global: true in ThrottlerModule options

B Add @Global() decorator to ThrottlerModule

C Use app.useGlobalGuards(new ThrottlerGuard()) in main.ts

D Import ThrottlerGuard in every controller

You call app.useGlobalGuards(new ThrottlerGuard()) in the main bootstrap file.

Which of these is NOT a benefit of using rate limiting?

A Preventing server overload

B Stopping brute force attacks

C Reducing spam requests

D Improving user interface design

Rate limiting helps with security and performance, but not directly with UI design.

Explain how to set up global rate limiting in a NestJS application using the Throttler package.

Think about module imports and global guards.

Describe how you can customize rate limits for individual routes in NestJS with throttler.

Focus on decorators for route-level control.

Practice

1. What is the main purpose of using the @Throttle(ttl, limit) decorator in a NestJS application?

easy

A. To limit how many requests a user can make in a given time

B. To increase the speed of API responses

C. To log all incoming requests for debugging

D. To automatically retry failed requests

Solution

1. Step 1: Understand the purpose of rate limiting

   Rate limiting is used to protect an app from too many requests in a short time.

2. Step 2: Role of @Throttle(ttl, limit)

   This decorator sets how many requests are allowed within a time window (ttl).

3. Final Answer:

   To limit how many requests a user can make in a given time -> Option A

4. Quick Check:

   Rate limiting = request limit [OK]

Hint: Throttle controls request count per time window [OK]

Common Mistakes:

• Confusing throttling with logging
• Thinking it speeds up responses
• Assuming it retries failed requests

2. Which of the following is the correct way to apply a rate limit of 10 requests per 60 seconds on a NestJS controller method?

easy

A. @Throttle(10, 60)

B. @Throttle(60, 10)

C. @Throttle(60)

D. @Throttle(limit=10, ttl=60)

Solution

1. Step 1: Understand @Throttle(ttl, limit) parameter order

   The first parameter is ttl (time to live in seconds), second is limit (max requests).

2. Step 2: Match parameters to desired limit

   For 10 requests per 60 seconds, ttl=60 and limit=10, so @Throttle(60, 10).

3. Final Answer:

   @Throttle(60, 10) -> Option B

4. Quick Check:

   ttl first, limit second = @Throttle(60, 10) [OK]

Hint: Remember: first ttl (seconds), then limit (count) [OK]

Common Mistakes:

• Swapping ttl and limit parameters
• Using named parameters which are unsupported
• Providing only one parameter

3. Given the following code snippet, what will happen if a user sends 6 requests within 10 seconds?

import { Controller, Get } from '@nestjs/common';
import { Throttle } from '@nestjs/throttler';

@Controller('api')
export class ApiController {
  @Get('data')
  @Throttle(10, 5)
  getData() {
    return 'Success';
  }
}

medium

A. First 5 requests return 'Success', 6th request is blocked

B. Only the 6th request returns 'Success'

C. All requests are blocked

D. All 6 requests return 'Success'

Solution

1. Step 1: Analyze the throttle settings

   @Throttle(10, 5) means 5 requests allowed per 10 seconds.

2. Step 2: Evaluate request count against limit

   6 requests exceed the limit by 1, so the 6th request is blocked.

3. Final Answer:

   First 5 requests return 'Success', 6th request is blocked -> Option A

4. Quick Check:

   Limit 5 per 10s, 6th blocked [OK]

Hint: Requests over limit get blocked after limit reached [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking limit is per request instead of per time window
• Confusing ttl and limit values

4. You added @Throttle(60, 10) to a controller method but it does not limit requests as expected. What is the most likely cause?

medium

A. The parameters are reversed; it should be @Throttle(10, 60)

B. The @Throttle decorator only works on services, not controllers

C. You forgot to import and configure ThrottlerModule in your app module

D. You need to restart the server after adding the decorator

Solution

1. Step 1: Check if ThrottlerModule is configured

   Throttling requires ThrottlerModule.forRoot() to be imported in the app module.

2. Step 2: Understand decorator usage and parameters

   The decorator works on controllers and methods; parameter order is correct as @Throttle(60, 10).

3. Final Answer:

   You forgot to import and configure ThrottlerModule in your app module -> Option C

4. Quick Check:

   Module config required for throttling [OK]

Hint: Always import ThrottlerModule to enable throttling [OK]

Common Mistakes:

• Assuming decorator works without module setup
• Swapping ttl and limit parameters
• Not restarting server after changes (usually needed but not main cause)

5. You want to apply a global rate limit of 100 requests per 60 seconds for your entire NestJS app, but allow a specific controller to have a higher limit of 200 requests per 60 seconds. How should you configure this using the throttler?

hard

A. Add @Throttle(100, 60) globally and @Throttle(200, 60) on the controller

B. Set ThrottlerModule.forRoot({ ttl: 200, limit: 60 }) globally and add @Throttle(100, 60) on the controller

C. Set ThrottlerModule.forRoot({ ttl: 100, limit: 60 }) globally and add @Throttle(200, 60) on the controller

D. Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller

Solution

1. Step 1: Configure global throttling in ThrottlerModule.forRoot()

   Global settings use { ttl: 60, limit: 100 } for 100 requests per 60 seconds.

2. Step 2: Override limit on specific controller with @Throttle(60, 200)

   The decorator parameters are @Throttle(ttl, limit), so 200 requests per 60 seconds overrides global limit.

3. Final Answer:

   Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller -> Option D

4. Quick Check:

   Global config + decorator override = Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller [OK]

Hint: Global config in module, override with decorator on controller [OK]

Common Mistakes:

• Swapping ttl and limit in decorator
• Misconfiguring global module parameters
• Trying to set global limits with decorators only