Rate limiting in Node.js

Introduction

Rate limiting helps control how many times someone can use a service in a set time. It stops too many requests that can slow down or break your app.

To stop users from sending too many requests to your server quickly.

To protect your app from being overwhelmed by bots or attacks.

To make sure everyone gets fair access to your service.

To avoid extra costs from too many API calls.

To keep your app running smoothly during high traffic.

Syntax

Node.js

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // time window in milliseconds
  max: 100, // max requests per window per IP
  message: 'Too many requests, please try again later.',
});

app.use(limiter);

windowMs sets the time frame for counting requests.

max is how many requests are allowed in that time.

Examples

Limits to 10 requests per minute per IP.

Node.js

const limiter = rateLimit({ windowMs: 60000, max: 10 });

Limits to 50 requests per 5 minutes with a custom message.

Node.js

const limiter = rateLimit({ windowMs: 5 * 60 * 1000, max: 50, message: 'Slow down!' });

Applies rate limiting only to routes starting with /api/.

Node.js

app.use('/api/', rateLimit({ windowMs: 60000, max: 20 }));

Sample Program

This simple Express server limits each user to 3 requests per minute. If they try more, they get a message telling them to wait.

Node.js

import express from 'express';
import rateLimit from 'express-rate-limit';

const app = express();

const limiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 3, // limit each IP to 3 requests per windowMs
  message: 'Too many requests, please wait a minute.',
});

app.use(limiter);

app.get('/', (req, res) => {
  res.send('Hello, world!');
});

app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});

Important Notes

Rate limiting works best with user IP addresses to track requests.

Adjust windowMs and max to fit your app's needs.

Use custom messages to inform users politely when they hit the limit.

Summary

Rate limiting protects your app from too many requests.

It controls traffic by setting request limits per time window.

Easy to add in Node.js apps using middleware like express-rate-limit.

Practice

1. What is the main purpose of rate limiting in a Node.js application?

easy

A. To store user data securely

B. To speed up the server response time

C. To control the number of requests a user can make in a set time

D. To automatically restart the server on errors

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts how many requests a user can send to prevent overload.

2. Step 2: Identify the main goal in Node.js apps

   It protects the app by limiting requests per time window, avoiding abuse.

3. Final Answer:

   To control the number of requests a user can make in a set time -> Option C

4. Quick Check:

   Rate limiting = request control [OK]

Hint: Rate limiting controls request count per time window [OK]

Common Mistakes:

• Confusing rate limiting with speeding up server
• Thinking it stores user data
• Assuming it restarts the server automatically

2. Which of the following is the correct way to import the express-rate-limit middleware in a Node.js app?

easy

A. require rateLimit from 'express-rate-limit';

B. const rateLimit = require('express-rate-limit');

C. const rateLimit = import('express-rate-limit');

D. import rateLimit from 'express-rate-limit';

Solution

1. Step 1: Identify import syntax in Node.js

   Node.js commonly uses CommonJS syntax with const rateLimit = require('express-rate-limit'); unless using ES modules.

2. Step 2: Check each option for syntax correctness

   const rateLimit = require('express-rate-limit'); uses correct CommonJS require syntax; import rateLimit from 'express-rate-limit'; is ES module syntax which requires specific setup.

3. Final Answer:

   const rateLimit = require('express-rate-limit'); -> Option B

4. Quick Check:

   CommonJS require = const rateLimit = require('express-rate-limit'); [OK]

Hint: Use require() in CommonJS Node.js projects [OK]

Common Mistakes:

• Using ES module import without setup
• Trying to import asynchronously with import()
• Incorrect require syntax without parentheses

3. Given this code snippet using express-rate-limit, what will happen if a client sends 6 requests within 10 seconds?

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 10000, // 10 seconds
  max: 5
});

app.use(limiter);

medium

A. Only the first 5 requests will be accepted; the 6th will be blocked

B. All 6 requests will be accepted

C. Only the last request will be accepted

D. The server will crash after 5 requests

Solution

1. Step 1: Understand the rate limit settings

   The limiter allows max 5 requests per 10 seconds per client.

2. Step 2: Analyze client requests count

   Client sends 6 requests in 10 seconds; first 5 pass, 6th exceeds limit and is blocked.

3. Final Answer:

   Only the first 5 requests will be accepted; the 6th will be blocked -> Option A

4. Quick Check:

   Max 5 requests = 6th blocked [OK]

Hint: Requests over max in window get blocked [OK]

Common Mistakes:

• Assuming all requests pass
• Thinking only last request passes
• Believing server crashes on limit

4. Identify the error in this rate limiting middleware setup:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 'one minute',
  max: 10
});

app.use(limiter);

medium

A. windowMs should be a number, not a string

B. max should be a string, not a number

C. rateLimit must be called with parentheses

D. app.use cannot accept middleware

Solution

1. Step 1: Check windowMs type requirement

   windowMs expects a number representing milliseconds, not a string.

2. Step 2: Identify the error in the code

   windowMs is given as 'one minute' (string), which causes incorrect behavior or error.

3. Final Answer:

   windowMs should be a number, not a string -> Option A

4. Quick Check:

   windowMs type = number [OK]

Hint: windowMs must be a number, not quoted string [OK]

Common Mistakes:

• Passing windowMs as string
• Confusing max type
• Thinking app.use can't use middleware

5. You want to apply rate limiting only to API routes starting with /api/ in your Express app. Which code snippet correctly applies the limiter only to those routes?

hard

A. app.use('/api/', limiter);

B. app.use(limiter);

C. app.use('/api/*', limiter);

D. app.use('/api', limiter);

Solution

1. Step 1: Understand Express route prefix matching

   Using app.use('/api', limiter); applies middleware to all routes starting with '/api'.

2. Step 2: Evaluate other options

   app.use('/api', limiter); correctly applies limiter to all routes starting with '/api'. app.use('/api/', limiter); applies only to routes starting with '/api/' (with trailing slash), which may exclude '/api' itself.

3. Final Answer:

   app.use('/api', limiter); -> Option D

4. Quick Check:

   Prefix '/api' applies limiter correctly [OK]

Hint: Use app.use('/api', limiter) for route-specific limiting [OK]

Common Mistakes:

• Applying limiter globally by mistake
• Using invalid route patterns
• Confusing trailing slash effects