Rate limiting with throttler in NestJS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the ThrottlerModule in a NestJS module.

NestJS

import { Module } from '@nestjs/common';
import { ThrottlerModule } from '@nestjs/throttler';

@Module({
  imports: [ThrottlerModule.[1]({ ttl: 60, limit: 10 })],
})
export class AppModule {}

Drag options to blanks, or click blank then click option'

AforRoot

Bcreate

Cregister

DforRootAsync

Attempts:

3 left

💡 Hint

Common Mistakes

Using forRootAsync without async configuration.

Using register which is not a method of ThrottlerModule.

Using create which does not exist.

The ThrottlerModule is imported using the forRoot() method to set global rate limiting options.

2fill in blank

medium

Complete the code to apply the ThrottlerGuard globally in the module using providers.

NestJS

import { Module } from '@nestjs/common';
import { ThrottlerGuard } from '@nestjs/throttler';
import { [1] } from '@nestjs/core';

@Module({
  providers: [
    {
      provide: [1],
      useClass: ThrottlerGuard
    }
  ],
})
export class AppModule {}

Drag options to blanks, or click blank then click option'

AAPP_GUARD

BGuard

CCanActivate

DInjectable

Attempts:

3 left

💡 Hint

Common Mistakes

Importing CanActivate which is an interface, not a token.

Importing Guard which does not exist.

Importing Injectable which is a decorator.

APP_GUARD is imported from '@nestjs/core' to provide global guard tokens. It is used as the provide token to register ThrottlerGuard as a global guard.

3fill in blank

hard

Fix the error in the controller method to apply rate limiting with @Throttle decorator.

NestJS

import { Controller, Get } from '@nestjs/common';
import { Throttle } from '@nestjs/throttler';

@Controller('cats')
export class CatsController {
  @Get()
  @Throttle([1])
  findAll() {
    return 'This action returns all cats';
  }
}

Drag options to blanks, or click blank then click option'

A10, ttl: 60

B10, 60

C60, 10

D{ limit: 10, ttl: 60 }

Attempts:

3 left

💡 Hint

Common Mistakes

Passing an object instead of two numbers.

Using named parameters inside the decorator.

Passing a single number.

The @Throttle decorator takes two positional arguments: limit and ttl (time to live in seconds). So @Throttle(10, 60) means max 10 requests per 60 seconds.

4fill in blank

hard

Fill both blanks to configure ThrottlerModule with a 30-second window and 5 requests limit.

NestJS

import { Module } from '@nestjs/common';
import { ThrottlerModule } from '@nestjs/throttler';

@Module({
  imports: [ThrottlerModule.forRoot({ ttl: [1], limit: [2] })],
})
export class AppModule {}

Drag options to blanks, or click blank then click option'

A30

B5

C60

D10

Attempts:

3 left

💡 Hint

Common Mistakes

Swapping ttl and limit values.

Using default values instead of specified ones.

The ttl is the time window in seconds (30), and limit is the max requests allowed (5).

5fill in blank

hard

Fill all three blanks to create a custom ThrottlerGuard that ignores requests from admin users.

NestJS

import { Injectable, ExecutionContext } from '@nestjs/common';
import { ThrottlerGuard } from '@nestjs/throttler';

@Injectable()
export class [1] extends ThrottlerGuard {
  protected getTracker(req: any): string {
    const user = req.user;
    if (user && user.role === [2]) {
      return [3];
    }
    return super.getTracker(req);
  }
}

Drag options to blanks, or click blank then click option'

ACustomThrottlerGuard

B'admin'

C'skip'

DAdminGuard

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect class names.

Using role without quotes.

Returning wrong string to skip rate limiting.

The class is named CustomThrottlerGuard, the role to check is 'admin', and returning 'skip' tells the guard to ignore rate limiting for that user.

Practice

1. What is the main purpose of using the @Throttle(ttl, limit) decorator in a NestJS application?

easy

A. To limit how many requests a user can make in a given time

B. To increase the speed of API responses

C. To log all incoming requests for debugging

D. To automatically retry failed requests

Solution

1. Step 1: Understand the purpose of rate limiting

   Rate limiting is used to protect an app from too many requests in a short time.

2. Step 2: Role of @Throttle(ttl, limit)

   This decorator sets how many requests are allowed within a time window (ttl).

3. Final Answer:

   To limit how many requests a user can make in a given time -> Option A

4. Quick Check:

   Rate limiting = request limit [OK]

Hint: Throttle controls request count per time window [OK]

Common Mistakes:

• Confusing throttling with logging
• Thinking it speeds up responses
• Assuming it retries failed requests

2. Which of the following is the correct way to apply a rate limit of 10 requests per 60 seconds on a NestJS controller method?

easy

A. @Throttle(10, 60)

B. @Throttle(60, 10)

C. @Throttle(60)

D. @Throttle(limit=10, ttl=60)

Solution

1. Step 1: Understand @Throttle(ttl, limit) parameter order

   The first parameter is ttl (time to live in seconds), second is limit (max requests).

2. Step 2: Match parameters to desired limit

   For 10 requests per 60 seconds, ttl=60 and limit=10, so @Throttle(60, 10).

3. Final Answer:

   @Throttle(60, 10) -> Option B

4. Quick Check:

   ttl first, limit second = @Throttle(60, 10) [OK]

Hint: Remember: first ttl (seconds), then limit (count) [OK]

Common Mistakes:

• Swapping ttl and limit parameters
• Using named parameters which are unsupported
• Providing only one parameter

3. Given the following code snippet, what will happen if a user sends 6 requests within 10 seconds?

import { Controller, Get } from '@nestjs/common';
import { Throttle } from '@nestjs/throttler';

@Controller('api')
export class ApiController {
  @Get('data')
  @Throttle(10, 5)
  getData() {
    return 'Success';
  }
}

medium

A. First 5 requests return 'Success', 6th request is blocked

B. Only the 6th request returns 'Success'

C. All requests are blocked

D. All 6 requests return 'Success'

Solution

1. Step 1: Analyze the throttle settings

   @Throttle(10, 5) means 5 requests allowed per 10 seconds.

2. Step 2: Evaluate request count against limit

   6 requests exceed the limit by 1, so the 6th request is blocked.

3. Final Answer:

   First 5 requests return 'Success', 6th request is blocked -> Option A

4. Quick Check:

   Limit 5 per 10s, 6th blocked [OK]

Hint: Requests over limit get blocked after limit reached [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking limit is per request instead of per time window
• Confusing ttl and limit values

4. You added @Throttle(60, 10) to a controller method but it does not limit requests as expected. What is the most likely cause?

medium

A. The parameters are reversed; it should be @Throttle(10, 60)

B. The @Throttle decorator only works on services, not controllers

C. You forgot to import and configure ThrottlerModule in your app module

D. You need to restart the server after adding the decorator

Solution

1. Step 1: Check if ThrottlerModule is configured

   Throttling requires ThrottlerModule.forRoot() to be imported in the app module.

2. Step 2: Understand decorator usage and parameters

   The decorator works on controllers and methods; parameter order is correct as @Throttle(60, 10).

3. Final Answer:

   You forgot to import and configure ThrottlerModule in your app module -> Option C

4. Quick Check:

   Module config required for throttling [OK]

Hint: Always import ThrottlerModule to enable throttling [OK]

Common Mistakes:

• Assuming decorator works without module setup
• Swapping ttl and limit parameters
• Not restarting server after changes (usually needed but not main cause)

5. You want to apply a global rate limit of 100 requests per 60 seconds for your entire NestJS app, but allow a specific controller to have a higher limit of 200 requests per 60 seconds. How should you configure this using the throttler?

hard

A. Add @Throttle(100, 60) globally and @Throttle(200, 60) on the controller

B. Set ThrottlerModule.forRoot({ ttl: 200, limit: 60 }) globally and add @Throttle(100, 60) on the controller

C. Set ThrottlerModule.forRoot({ ttl: 100, limit: 60 }) globally and add @Throttle(200, 60) on the controller

D. Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller

Solution

1. Step 1: Configure global throttling in ThrottlerModule.forRoot()

   Global settings use { ttl: 60, limit: 100 } for 100 requests per 60 seconds.

2. Step 2: Override limit on specific controller with @Throttle(60, 200)

   The decorator parameters are @Throttle(ttl, limit), so 200 requests per 60 seconds overrides global limit.

3. Final Answer:

   Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller -> Option D

4. Quick Check:

   Global config + decorator override = Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller [OK]

Hint: Global config in module, override with decorator on controller [OK]

Common Mistakes:

• Swapping ttl and limit in decorator
• Misconfiguring global module parameters
• Trying to set global limits with decorators only