Rate limiting with throttler in NestJS - Step-by-Step Execution

Concept Flow - Rate limiting with throttler

Incoming Request

↓

Check Throttler

↓

Requests in Time Window <= Limit?

No→Reject Request with 429

Yes↓

Allow Request to Controller

↓

Update Request Count

↓

Send Response

The throttler checks each request count within a time window. If the count is below the limit, it allows the request and updates the count. Otherwise, it rejects the request.

Execution Sample

NestJS

import { Throttle } from '@nestjs/throttler';
import { Controller, Get } from '@nestjs/common';

@Controller()
export class AppController {
  @Throttle(2, 10)
  @Get('data')
  getData() {
    return 'Hello';
  }
}

This code limits the 'getData' endpoint to 2 requests every 10 seconds per user.

Execution Table

Step	Request Number	Time (s)	Requests in Window	Condition (<=2?)	Action	Response
1	1	0	1	Yes	Allow request	'Hello'
2	2	5	2	Yes	Allow request	'Hello'
3	3	7	3	No	Reject request	429 Too Many Requests
4	4	11	2	Yes	Allow request	'Hello'
5	5	15	2	Yes	Allow request	'Hello'
6	6	16	3	No	Reject request	429 Too Many Requests

💡 Requests exceeding 2 within 10 seconds are rejected with 429 status.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After 5	After 6
requestsInWindow	0	1	2	3 (rejected)	2	2	3 (rejected)

Key Moments - 2 Insights

Why is the third request rejected even though it is close in time to the first two?

Because the limit is 2 requests per 10 seconds, and at step 3 there are already 2 requests counted within the last 10 seconds, so the third exceeds the limit (see execution_table row 3).

Why does the request count drop back to 2 at step 4?

Because the first request at time 0 is now outside the 10-second window at time 11, so it is no longer counted (see execution_table row 4).

Visual Quiz - 3 Questions

Look at the execution table, what is the response for the 3rd request at 7 seconds?

A 429 Too Many Requests

B 500 Internal Server Error

C 'Hello'

D Request Pending

💡 Hint

Check the 'Response' column at Step 3 in the execution_table.

At which step does the requests count drop because the oldest request leaves the time window?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look at the 'Requests in Window' column and see when it decreases after being 3.

If the limit was changed to 3 requests per 10 seconds, what would happen at step 6?

A Request would be rejected

B Request would be allowed

C Request count resets to 0

D Request causes server error

💡 Hint

Compare the 'Requests in Window' at step 6 with the new limit.

Concept Snapshot

Use @Throttle(limit, ttl) decorator on controller methods.
Limit = max requests allowed.
TTL = time window in seconds.
Requests over limit get 429 error.
Throttler tracks requests per user/IP.
Helps protect APIs from overload.

Full Transcript

Rate limiting with throttler in NestJS works by checking each incoming request against a set limit within a time window. The @Throttle decorator sets how many requests are allowed and the time frame. When a request comes in, the throttler counts how many requests have been made recently. If the count is below the limit, the request is allowed and the count updates. If the count is at or above the limit, the request is rejected with a 429 Too Many Requests error. This prevents users from sending too many requests too quickly. The example code limits an endpoint to 2 requests every 10 seconds. The execution table shows requests allowed or rejected based on timing and count. When the oldest request leaves the time window, the count decreases, allowing new requests. This helps keep the server safe and responsive.

Practice

1. What is the main purpose of using the @Throttle(ttl, limit) decorator in a NestJS application?

easy

A. To limit how many requests a user can make in a given time

B. To increase the speed of API responses

C. To log all incoming requests for debugging

D. To automatically retry failed requests

Solution

1. Step 1: Understand the purpose of rate limiting

   Rate limiting is used to protect an app from too many requests in a short time.

2. Step 2: Role of @Throttle(ttl, limit)

   This decorator sets how many requests are allowed within a time window (ttl).

3. Final Answer:

   To limit how many requests a user can make in a given time -> Option A

4. Quick Check:

   Rate limiting = request limit [OK]

Hint: Throttle controls request count per time window [OK]

Common Mistakes:

• Confusing throttling with logging
• Thinking it speeds up responses
• Assuming it retries failed requests

2. Which of the following is the correct way to apply a rate limit of 10 requests per 60 seconds on a NestJS controller method?

easy

A. @Throttle(10, 60)

B. @Throttle(60, 10)

C. @Throttle(60)

D. @Throttle(limit=10, ttl=60)

Solution

1. Step 1: Understand @Throttle(ttl, limit) parameter order

   The first parameter is ttl (time to live in seconds), second is limit (max requests).

2. Step 2: Match parameters to desired limit

   For 10 requests per 60 seconds, ttl=60 and limit=10, so @Throttle(60, 10).

3. Final Answer:

   @Throttle(60, 10) -> Option B

4. Quick Check:

   ttl first, limit second = @Throttle(60, 10) [OK]

Hint: Remember: first ttl (seconds), then limit (count) [OK]

Common Mistakes:

• Swapping ttl and limit parameters
• Using named parameters which are unsupported
• Providing only one parameter

3. Given the following code snippet, what will happen if a user sends 6 requests within 10 seconds?

import { Controller, Get } from '@nestjs/common';
import { Throttle } from '@nestjs/throttler';

@Controller('api')
export class ApiController {
  @Get('data')
  @Throttle(10, 5)
  getData() {
    return 'Success';
  }
}

medium

A. First 5 requests return 'Success', 6th request is blocked

B. Only the 6th request returns 'Success'

C. All requests are blocked

D. All 6 requests return 'Success'

Solution

1. Step 1: Analyze the throttle settings

   @Throttle(10, 5) means 5 requests allowed per 10 seconds.

2. Step 2: Evaluate request count against limit

   6 requests exceed the limit by 1, so the 6th request is blocked.

3. Final Answer:

   First 5 requests return 'Success', 6th request is blocked -> Option A

4. Quick Check:

   Limit 5 per 10s, 6th blocked [OK]

Hint: Requests over limit get blocked after limit reached [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking limit is per request instead of per time window
• Confusing ttl and limit values

4. You added @Throttle(60, 10) to a controller method but it does not limit requests as expected. What is the most likely cause?

medium

A. The parameters are reversed; it should be @Throttle(10, 60)

B. The @Throttle decorator only works on services, not controllers

C. You forgot to import and configure ThrottlerModule in your app module

D. You need to restart the server after adding the decorator

Solution

1. Step 1: Check if ThrottlerModule is configured

   Throttling requires ThrottlerModule.forRoot() to be imported in the app module.

2. Step 2: Understand decorator usage and parameters

   The decorator works on controllers and methods; parameter order is correct as @Throttle(60, 10).

3. Final Answer:

   You forgot to import and configure ThrottlerModule in your app module -> Option C

4. Quick Check:

   Module config required for throttling [OK]

Hint: Always import ThrottlerModule to enable throttling [OK]

Common Mistakes:

• Assuming decorator works without module setup
• Swapping ttl and limit parameters
• Not restarting server after changes (usually needed but not main cause)

5. You want to apply a global rate limit of 100 requests per 60 seconds for your entire NestJS app, but allow a specific controller to have a higher limit of 200 requests per 60 seconds. How should you configure this using the throttler?

hard

A. Add @Throttle(100, 60) globally and @Throttle(200, 60) on the controller

B. Set ThrottlerModule.forRoot({ ttl: 200, limit: 60 }) globally and add @Throttle(100, 60) on the controller

C. Set ThrottlerModule.forRoot({ ttl: 100, limit: 60 }) globally and add @Throttle(200, 60) on the controller

D. Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller

Solution

1. Step 1: Configure global throttling in ThrottlerModule.forRoot()

   Global settings use { ttl: 60, limit: 100 } for 100 requests per 60 seconds.

2. Step 2: Override limit on specific controller with @Throttle(60, 200)

   The decorator parameters are @Throttle(ttl, limit), so 200 requests per 60 seconds overrides global limit.

3. Final Answer:

   Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller -> Option D

4. Quick Check:

   Global config + decorator override = Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller [OK]

Hint: Global config in module, override with decorator on controller [OK]

Common Mistakes:

• Swapping ttl and limit in decorator
• Misconfiguring global module parameters
• Trying to set global limits with decorators only