Rate limiting in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when the rate limit is exceeded in this Express middleware?

Consider this Express.js middleware using the express-rate-limit package:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 5,
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', limiter);

What will the server respond with if a client makes 6 requests within one minute to /api/?

Node.js

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 5,
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', limiter);

A The 6th request responds with HTTP 429 Too Many Requests and a JSON error message.

B The 6th request is queued and delayed until the window resets.

C The 6th request is accepted but logged as a warning on the server.

D The 6th request resets the count and is accepted normally.

💡 Hint

Think about what HTTP status code is standard for rate limiting.

The express-rate-limit middleware blocks requests exceeding the max limit within the time window. It responds with HTTP 429 Too Many Requests and a JSON message by default.

📝 Syntax

intermediate

Which option correctly sets up a rate limiter allowing 10 requests per 10 seconds?

Choose the correct code snippet to create a rate limiter with express-rate-limit that allows 10 requests every 10 seconds.

A rateLimit({ windowMs: 10, max: 10 })

B rateLimit({ windowMs: 10000, max: 10 })

C rateLimit({ windowMs: 10000, maxRequests: 10 })

D rateLimit({ max: 10, window: 10000 })

💡 Hint

Check the exact option names and units expected by express-rate-limit.

The windowMs option expects milliseconds, so 10 seconds is 10000 ms. The max option sets the max requests allowed.

🔧 Debug

advanced

Why does this rate limiter not block requests as expected?

Review this code snippet:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 3
});

app.get('/data', limiter, (req, res) => {
  res.send('Data response');
});

Clients report they can make unlimited requests without being blocked. What is the most likely cause?

Node.js

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 3
});

app.get('/data', limiter, (req, res) => {
  res.send('Data response');
});

A The app is behind a proxy but <code>trust proxy</code> is not enabled, so client IPs are not detected correctly.

B The <code>max</code> value is too high to trigger blocking within 1 minute.

C The middleware is applied only to GET requests, so POST requests bypass it.

D The <code>windowMs</code> value is too low to count requests properly.

💡 Hint

Think about how Express detects client IP addresses behind proxies.

If the app is behind a proxy (like Nginx), Express needs app.set('trust proxy', 1) to correctly identify client IPs. Without it, all requests appear from the proxy IP, so rate limiting does not work per client.

🧠 Conceptual

advanced

What is the main benefit of using a distributed store with rate limiting middleware?

When deploying a Node.js app with multiple server instances, why should you use a distributed store (like Redis) for rate limiting data?

A It speeds up request processing by caching responses in memory.

B It reduces the memory usage on each server by offloading logs.

C It automatically blocks IP addresses based on geographic location.

D It shares rate limit counters across all instances, preventing clients from bypassing limits by switching servers.

💡 Hint

Think about what happens when multiple servers handle requests independently.

Without a shared store, each server tracks limits separately. Clients can bypass limits by hitting different servers. A distributed store centralizes counters to enforce limits globally.

❓ state_output

expert

What is the value of the 'X-RateLimit-Remaining' header after 3 requests?

Given this Express.js setup:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 5,
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', limiter);

If a client makes 3 requests in the current window, what will the X-RateLimit-Remaining header value be on the 3rd response?

Node.js

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 5,
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', limiter);

A 0

B 3

C 2

D 5

💡 Hint

Remember the header shows how many requests remain before hitting the limit.

The limit is 5 requests per window. After 3 requests, 2 remain, so the header value is 2.

Practice

1. What is the main purpose of rate limiting in a Node.js application?

easy

A. To store user data securely

B. To speed up the server response time

C. To control the number of requests a user can make in a set time

D. To automatically restart the server on errors

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts how many requests a user can send to prevent overload.

2. Step 2: Identify the main goal in Node.js apps

   It protects the app by limiting requests per time window, avoiding abuse.

3. Final Answer:

   To control the number of requests a user can make in a set time -> Option C

4. Quick Check:

   Rate limiting = request control [OK]

Hint: Rate limiting controls request count per time window [OK]

Common Mistakes:

• Confusing rate limiting with speeding up server
• Thinking it stores user data
• Assuming it restarts the server automatically

2. Which of the following is the correct way to import the express-rate-limit middleware in a Node.js app?

easy

A. require rateLimit from 'express-rate-limit';

B. const rateLimit = require('express-rate-limit');

C. const rateLimit = import('express-rate-limit');

D. import rateLimit from 'express-rate-limit';

Solution

1. Step 1: Identify import syntax in Node.js

   Node.js commonly uses CommonJS syntax with const rateLimit = require('express-rate-limit'); unless using ES modules.

2. Step 2: Check each option for syntax correctness

   const rateLimit = require('express-rate-limit'); uses correct CommonJS require syntax; import rateLimit from 'express-rate-limit'; is ES module syntax which requires specific setup.

3. Final Answer:

   const rateLimit = require('express-rate-limit'); -> Option B

4. Quick Check:

   CommonJS require = const rateLimit = require('express-rate-limit'); [OK]

Hint: Use require() in CommonJS Node.js projects [OK]

Common Mistakes:

• Using ES module import without setup
• Trying to import asynchronously with import()
• Incorrect require syntax without parentheses

3. Given this code snippet using express-rate-limit, what will happen if a client sends 6 requests within 10 seconds?

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 10000, // 10 seconds
  max: 5
});

app.use(limiter);

medium

A. Only the first 5 requests will be accepted; the 6th will be blocked

B. All 6 requests will be accepted

C. Only the last request will be accepted

D. The server will crash after 5 requests

Solution

1. Step 1: Understand the rate limit settings

   The limiter allows max 5 requests per 10 seconds per client.

2. Step 2: Analyze client requests count

   Client sends 6 requests in 10 seconds; first 5 pass, 6th exceeds limit and is blocked.

3. Final Answer:

   Only the first 5 requests will be accepted; the 6th will be blocked -> Option A

4. Quick Check:

   Max 5 requests = 6th blocked [OK]

Hint: Requests over max in window get blocked [OK]

Common Mistakes:

• Assuming all requests pass
• Thinking only last request passes
• Believing server crashes on limit

4. Identify the error in this rate limiting middleware setup:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 'one minute',
  max: 10
});

app.use(limiter);

medium

A. windowMs should be a number, not a string

B. max should be a string, not a number

C. rateLimit must be called with parentheses

D. app.use cannot accept middleware

Solution

1. Step 1: Check windowMs type requirement

   windowMs expects a number representing milliseconds, not a string.

2. Step 2: Identify the error in the code

   windowMs is given as 'one minute' (string), which causes incorrect behavior or error.

3. Final Answer:

   windowMs should be a number, not a string -> Option A

4. Quick Check:

   windowMs type = number [OK]

Hint: windowMs must be a number, not quoted string [OK]

Common Mistakes:

• Passing windowMs as string
• Confusing max type
• Thinking app.use can't use middleware

5. You want to apply rate limiting only to API routes starting with /api/ in your Express app. Which code snippet correctly applies the limiter only to those routes?

hard

A. app.use('/api/', limiter);

B. app.use(limiter);

C. app.use('/api/*', limiter);

D. app.use('/api', limiter);

Solution

1. Step 1: Understand Express route prefix matching

   Using app.use('/api', limiter); applies middleware to all routes starting with '/api'.

2. Step 2: Evaluate other options

   app.use('/api', limiter); correctly applies limiter to all routes starting with '/api'. app.use('/api/', limiter); applies only to routes starting with '/api/' (with trailing slash), which may exclude '/api' itself.

3. Final Answer:

   app.use('/api', limiter); -> Option D

4. Quick Check:

   Prefix '/api' applies limiter correctly [OK]

Hint: Use app.use('/api', limiter) for route-specific limiting [OK]

Common Mistakes:

• Applying limiter globally by mistake
• Using invalid route patterns
• Confusing trailing slash effects