Rate limiting in Node.js - Performance & Optimization

Performance: Rate limiting

HIGH IMPACT

Rate limiting affects server response time and resource usage, impacting how quickly the server can handle requests and maintain responsiveness.

Controlling API request rate to prevent server overload

Node.js

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 100, // limit each IP to 100 requests per window
  standardHeaders: true,
  legacyHeaders: false
});

app.use(limiter);

Limits requests per IP, reducing server load and keeping response times stable.

📈 Performance GainPrevents spikes in CPU and memory use, improving INP and overall server responsiveness.

Controlling API request rate to prevent server overload

Node.js

app.use((req, res, next) => {
  // No rate limiting
  next();
});

No rate limiting allows unlimited requests, causing potential server overload and slow responses.

📉 Performance CostCan cause high CPU and memory usage, leading to slow response times and poor INP.

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
No rate limiting	N/A	N/A	N/A	[X] Bad
Basic in-memory rate limiting	N/A	N/A	N/A	[!] OK
Distributed Redis-backed rate limiting	N/A	N/A	N/A	[OK] Good

Rendering Pipeline

Rate limiting affects the server's request handling before rendering or responding, controlling how many requests proceed to processing.

→Request Handling

→Server Processing

⚠️ BottleneckServer Processing under high load without limits

Core Web Vital Affected

INP

Rate limiting affects server response time and resource usage, impacting how quickly the server can handle requests and maintain responsiveness.

Optimization Tips

1Always limit requests early in the server pipeline to reduce load.

2Use distributed stores like Redis for consistent rate limiting in multi-server environments.

3Monitor HTTP 429 responses and server response times to tune rate limits.

Performance Quiz - 3 Questions

What is the main performance benefit of implementing rate limiting on a Node.js server?

A Improves CSS rendering speed

B Prevents server overload by controlling request rate

C Reduces JavaScript bundle size

D Increases DOM nodes for faster rendering

DevTools: Network

How to check: Open DevTools, go to Network tab, observe response times and status codes under high request load.

What to look for: Look for HTTP 429 status codes indicating rate limiting and stable response times without spikes.

Practice

1. What is the main purpose of rate limiting in a Node.js application?

easy

A. To store user data securely

B. To speed up the server response time

C. To control the number of requests a user can make in a set time

D. To automatically restart the server on errors

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts how many requests a user can send to prevent overload.

2. Step 2: Identify the main goal in Node.js apps

   It protects the app by limiting requests per time window, avoiding abuse.

3. Final Answer:

   To control the number of requests a user can make in a set time -> Option C

4. Quick Check:

   Rate limiting = request control [OK]

Hint: Rate limiting controls request count per time window [OK]

Common Mistakes:

• Confusing rate limiting with speeding up server
• Thinking it stores user data
• Assuming it restarts the server automatically

2. Which of the following is the correct way to import the express-rate-limit middleware in a Node.js app?

easy

A. require rateLimit from 'express-rate-limit';

B. const rateLimit = require('express-rate-limit');

C. const rateLimit = import('express-rate-limit');

D. import rateLimit from 'express-rate-limit';

Solution

1. Step 1: Identify import syntax in Node.js

   Node.js commonly uses CommonJS syntax with const rateLimit = require('express-rate-limit'); unless using ES modules.

2. Step 2: Check each option for syntax correctness

   const rateLimit = require('express-rate-limit'); uses correct CommonJS require syntax; import rateLimit from 'express-rate-limit'; is ES module syntax which requires specific setup.

3. Final Answer:

   const rateLimit = require('express-rate-limit'); -> Option B

4. Quick Check:

   CommonJS require = const rateLimit = require('express-rate-limit'); [OK]

Hint: Use require() in CommonJS Node.js projects [OK]

Common Mistakes:

• Using ES module import without setup
• Trying to import asynchronously with import()
• Incorrect require syntax without parentheses

3. Given this code snippet using express-rate-limit, what will happen if a client sends 6 requests within 10 seconds?

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 10000, // 10 seconds
  max: 5
});

app.use(limiter);

medium

A. Only the first 5 requests will be accepted; the 6th will be blocked

B. All 6 requests will be accepted

C. Only the last request will be accepted

D. The server will crash after 5 requests

Solution

1. Step 1: Understand the rate limit settings

   The limiter allows max 5 requests per 10 seconds per client.

2. Step 2: Analyze client requests count

   Client sends 6 requests in 10 seconds; first 5 pass, 6th exceeds limit and is blocked.

3. Final Answer:

   Only the first 5 requests will be accepted; the 6th will be blocked -> Option A

4. Quick Check:

   Max 5 requests = 6th blocked [OK]

Hint: Requests over max in window get blocked [OK]

Common Mistakes:

• Assuming all requests pass
• Thinking only last request passes
• Believing server crashes on limit

4. Identify the error in this rate limiting middleware setup:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 'one minute',
  max: 10
});

app.use(limiter);

medium

A. windowMs should be a number, not a string

B. max should be a string, not a number

C. rateLimit must be called with parentheses

D. app.use cannot accept middleware

Solution

1. Step 1: Check windowMs type requirement

   windowMs expects a number representing milliseconds, not a string.

2. Step 2: Identify the error in the code

   windowMs is given as 'one minute' (string), which causes incorrect behavior or error.

3. Final Answer:

   windowMs should be a number, not a string -> Option A

4. Quick Check:

   windowMs type = number [OK]

Hint: windowMs must be a number, not quoted string [OK]

Common Mistakes:

• Passing windowMs as string
• Confusing max type
• Thinking app.use can't use middleware

5. You want to apply rate limiting only to API routes starting with /api/ in your Express app. Which code snippet correctly applies the limiter only to those routes?

hard

A. app.use('/api/', limiter);

B. app.use(limiter);

C. app.use('/api/*', limiter);

D. app.use('/api', limiter);

Solution

1. Step 1: Understand Express route prefix matching

   Using app.use('/api', limiter); applies middleware to all routes starting with '/api'.

2. Step 2: Evaluate other options

   app.use('/api', limiter); correctly applies limiter to all routes starting with '/api'. app.use('/api/', limiter); applies only to routes starting with '/api/' (with trailing slash), which may exclude '/api' itself.

3. Final Answer:

   app.use('/api', limiter); -> Option D

4. Quick Check:

   Prefix '/api' applies limiter correctly [OK]

Hint: Use app.use('/api', limiter) for route-specific limiting [OK]

Common Mistakes:

• Applying limiter globally by mistake
• Using invalid route patterns
• Confusing trailing slash effects