Why Rate limiting with throttler in NestJS? - Purpose & Use Cases

The Big Idea

What if a simple tool could stop your server from crashing under heavy traffic without extra code?

The Scenario

Imagine your web server suddenly gets flooded with hundreds of requests every second from many users or even bots.

You try to manually check each request and block the extra ones to keep your server safe.

The Problem

Manually tracking and blocking requests is slow and complicated.

You might miss some, block the wrong users, or crash your server trying to keep up.

The Solution

The throttler in NestJS automatically limits how many requests each user can make in a set time.

This keeps your server safe and running smoothly without extra work.

Before vs After

✗ Before

if (userRequests > limit) { return 'Too many requests'; }

✓ After

@Throttle(10, 60)
@Get()

What It Enables

You can protect your app from overload and abuse easily, ensuring fair use for everyone.

Real Life Example

A public API that only allows 100 requests per minute per user to prevent bots from spamming and crashing the service.

Key Takeaways

Manual request tracking is hard and error-prone.

Throttler automates request limits to protect your server.

This keeps your app stable and fair for all users.

Practice

1. What is the main purpose of using the @Throttle(ttl, limit) decorator in a NestJS application?

easy

A. To limit how many requests a user can make in a given time

B. To increase the speed of API responses

C. To log all incoming requests for debugging

D. To automatically retry failed requests

Solution

1. Step 1: Understand the purpose of rate limiting

   Rate limiting is used to protect an app from too many requests in a short time.

2. Step 2: Role of @Throttle(ttl, limit)

   This decorator sets how many requests are allowed within a time window (ttl).

3. Final Answer:

   To limit how many requests a user can make in a given time -> Option A

4. Quick Check:

   Rate limiting = request limit [OK]

Hint: Throttle controls request count per time window [OK]

Common Mistakes:

• Confusing throttling with logging
• Thinking it speeds up responses
• Assuming it retries failed requests

2. Which of the following is the correct way to apply a rate limit of 10 requests per 60 seconds on a NestJS controller method?

easy

A. @Throttle(10, 60)

B. @Throttle(60, 10)

C. @Throttle(60)

D. @Throttle(limit=10, ttl=60)

Solution

1. Step 1: Understand @Throttle(ttl, limit) parameter order

   The first parameter is ttl (time to live in seconds), second is limit (max requests).

2. Step 2: Match parameters to desired limit

   For 10 requests per 60 seconds, ttl=60 and limit=10, so @Throttle(60, 10).

3. Final Answer:

   @Throttle(60, 10) -> Option B

4. Quick Check:

   ttl first, limit second = @Throttle(60, 10) [OK]

Hint: Remember: first ttl (seconds), then limit (count) [OK]

Common Mistakes:

• Swapping ttl and limit parameters
• Using named parameters which are unsupported
• Providing only one parameter

3. Given the following code snippet, what will happen if a user sends 6 requests within 10 seconds?

import { Controller, Get } from '@nestjs/common';
import { Throttle } from '@nestjs/throttler';

@Controller('api')
export class ApiController {
  @Get('data')
  @Throttle(10, 5)
  getData() {
    return 'Success';
  }
}

medium

A. First 5 requests return 'Success', 6th request is blocked

B. Only the 6th request returns 'Success'

C. All requests are blocked

D. All 6 requests return 'Success'

Solution

1. Step 1: Analyze the throttle settings

   @Throttle(10, 5) means 5 requests allowed per 10 seconds.

2. Step 2: Evaluate request count against limit

   6 requests exceed the limit by 1, so the 6th request is blocked.

3. Final Answer:

   First 5 requests return 'Success', 6th request is blocked -> Option A

4. Quick Check:

   Limit 5 per 10s, 6th blocked [OK]

Hint: Requests over limit get blocked after limit reached [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking limit is per request instead of per time window
• Confusing ttl and limit values

4. You added @Throttle(60, 10) to a controller method but it does not limit requests as expected. What is the most likely cause?

medium

A. The parameters are reversed; it should be @Throttle(10, 60)

B. The @Throttle decorator only works on services, not controllers

C. You forgot to import and configure ThrottlerModule in your app module

D. You need to restart the server after adding the decorator

Solution

1. Step 1: Check if ThrottlerModule is configured

   Throttling requires ThrottlerModule.forRoot() to be imported in the app module.

2. Step 2: Understand decorator usage and parameters

   The decorator works on controllers and methods; parameter order is correct as @Throttle(60, 10).

3. Final Answer:

   You forgot to import and configure ThrottlerModule in your app module -> Option C

4. Quick Check:

   Module config required for throttling [OK]

Hint: Always import ThrottlerModule to enable throttling [OK]

Common Mistakes:

• Assuming decorator works without module setup
• Swapping ttl and limit parameters
• Not restarting server after changes (usually needed but not main cause)

5. You want to apply a global rate limit of 100 requests per 60 seconds for your entire NestJS app, but allow a specific controller to have a higher limit of 200 requests per 60 seconds. How should you configure this using the throttler?

hard

A. Add @Throttle(100, 60) globally and @Throttle(200, 60) on the controller

B. Set ThrottlerModule.forRoot({ ttl: 200, limit: 60 }) globally and add @Throttle(100, 60) on the controller

C. Set ThrottlerModule.forRoot({ ttl: 100, limit: 60 }) globally and add @Throttle(200, 60) on the controller

D. Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller

Solution

1. Step 1: Configure global throttling in ThrottlerModule.forRoot()

   Global settings use { ttl: 60, limit: 100 } for 100 requests per 60 seconds.

2. Step 2: Override limit on specific controller with @Throttle(60, 200)

   The decorator parameters are @Throttle(ttl, limit), so 200 requests per 60 seconds overrides global limit.

3. Final Answer:

   Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller -> Option D

4. Quick Check:

   Global config + decorator override = Set ThrottlerModule.forRoot({ ttl: 60, limit: 100 }) globally and add @Throttle(60, 200) on the specific controller [OK]

Hint: Global config in module, override with decorator on controller [OK]

Common Mistakes:

• Swapping ttl and limit in decorator
• Misconfiguring global module parameters
• Trying to set global limits with decorators only