Rate limiting in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when the rate limit is exceeded in this Express middleware?

Consider this Express.js middleware using the express-rate-limit package:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 5,
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', limiter);

What will the server respond with if a client makes 6 requests within one minute to /api/?

Node.js

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 5,
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', limiter);

A The 6th request responds with HTTP 429 Too Many Requests and a JSON error message.

B The 6th request is queued and delayed until the window resets.

C The 6th request is accepted but logged as a warning on the server.

D The 6th request resets the count and is accepted normally.

💡 Hint

Think about what HTTP status code is standard for rate limiting.

The express-rate-limit middleware blocks requests exceeding the max limit within the time window. It responds with HTTP 429 Too Many Requests and a JSON message by default.

📝 Syntax

intermediate

Which option correctly sets up a rate limiter allowing 10 requests per 10 seconds?

Choose the correct code snippet to create a rate limiter with express-rate-limit that allows 10 requests every 10 seconds.

A rateLimit({ windowMs: 10, max: 10 })

B rateLimit({ windowMs: 10000, max: 10 })

C rateLimit({ windowMs: 10000, maxRequests: 10 })

D rateLimit({ max: 10, window: 10000 })

💡 Hint

Check the exact option names and units expected by express-rate-limit.

The windowMs option expects milliseconds, so 10 seconds is 10000 ms. The max option sets the max requests allowed.

🔧 Debug

advanced

Why does this rate limiter not block requests as expected?

Review this code snippet:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 3
});

app.get('/data', limiter, (req, res) => {
  res.send('Data response');
});

Clients report they can make unlimited requests without being blocked. What is the most likely cause?

Node.js

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 3
});

app.get('/data', limiter, (req, res) => {
  res.send('Data response');
});

A The app is behind a proxy but <code>trust proxy</code> is not enabled, so client IPs are not detected correctly.

B The <code>max</code> value is too high to trigger blocking within 1 minute.

C The middleware is applied only to GET requests, so POST requests bypass it.

D The <code>windowMs</code> value is too low to count requests properly.

💡 Hint

Think about how Express detects client IP addresses behind proxies.

If the app is behind a proxy (like Nginx), Express needs app.set('trust proxy', 1) to correctly identify client IPs. Without it, all requests appear from the proxy IP, so rate limiting does not work per client.

🧠 Conceptual

advanced

What is the main benefit of using a distributed store with rate limiting middleware?

When deploying a Node.js app with multiple server instances, why should you use a distributed store (like Redis) for rate limiting data?

A It speeds up request processing by caching responses in memory.

B It reduces the memory usage on each server by offloading logs.

C It automatically blocks IP addresses based on geographic location.

D It shares rate limit counters across all instances, preventing clients from bypassing limits by switching servers.

💡 Hint

Think about what happens when multiple servers handle requests independently.

Without a shared store, each server tracks limits separately. Clients can bypass limits by hitting different servers. A distributed store centralizes counters to enforce limits globally.

❓ state_output

expert

What is the value of the 'X-RateLimit-Remaining' header after 3 requests?

Given this Express.js setup:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 5,
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', limiter);

If a client makes 3 requests in the current window, what will the X-RateLimit-Remaining header value be on the 3rd response?

Node.js

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000,
  max: 5,
  standardHeaders: true,
  legacyHeaders: false
});

app.use('/api/', limiter);

A 0

B 3

C 2

D 5

💡 Hint

Remember the header shows how many requests remain before hitting the limit.

The limit is 5 requests per window. After 3 requests, 2 remain, so the header value is 2.