Rate limiting in Node.js - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the rate limiting middleware from the 'express-rate-limit' package.

Node.js

const rateLimit = require('[1]');

Drag options to blanks, or click blank then click option'

Aexpress-rate-limit

Bexpress-limit

Crate-limit-express

Dexpress-rate

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect package names like 'express-rate' or 'express-limit'.

Forgetting to install the package before importing.

The correct package name to import the rate limiting middleware is express-rate-limit.

2fill in blank

medium

Complete the code to create a rate limiter that allows 100 requests per 15 minutes.

Node.js

const limiter = rateLimit({ windowMs: [1], max: 100 });

Drag options to blanks, or click blank then click option'

A900000

B60000

C15000

D3600000

Attempts:

3 left

💡 Hint

Common Mistakes

Using seconds instead of milliseconds.

Confusing 15 seconds with 15 minutes.

The windowMs option is in milliseconds. 15 minutes equals 900,000 milliseconds.

3fill in blank

hard

Fix the error in applying the rate limiter middleware to an Express app.

Node.js

app.[1](limiter);

Drag options to blanks, or click blank then click option'

Arun

Blisten

Capply

Duse

Attempts:

3 left

💡 Hint

Common Mistakes

Using app.apply() or app.run() which do not exist.

Trying to use app.listen() to add middleware.

In Express, middleware is added using the use method.

4fill in blank

hard

Fill both blanks to create a rate limiter that sends a custom message when the limit is exceeded.

Node.js

const limiter = rateLimit({ windowMs: 60000, max: 10, message: '[1]', statusCode: [2] });

Drag options to blanks, or click blank then click option'

AToo many requests, please try again later.

B429

C500

DRequest limit exceeded

Attempts:

3 left

💡 Hint

Common Mistakes

Using status code 500 which means server error.

Leaving the message blank or unclear.

The message option sets the response text, and statusCode should be 429 for too many requests.

5fill in blank

hard

Fill all three blanks to create a rate limiter that uses a custom key generator and skips requests from localhost.

Node.js

const limiter = rateLimit({ windowMs: 60000, max: 5, keyGenerator: (req) => req.[1], skip: (req) => req.[2] === '[3]' });

Drag options to blanks, or click blank then click option'

Aip

Bhostname

C127.0.0.1

Durl

Attempts:

3 left

💡 Hint

Common Mistakes

Using req.hostname, which is the requested hostname from the Host header, not the client IP.

Checking req.url instead of IP for skipping.

The keyGenerator uses req.ip to identify clients. The skip function checks if req.ip equals 127.0.0.1 to skip rate limiting.

Practice

1. What is the main purpose of rate limiting in a Node.js application?

easy

A. To store user data securely

B. To speed up the server response time

C. To control the number of requests a user can make in a set time

D. To automatically restart the server on errors

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts how many requests a user can send to prevent overload.

2. Step 2: Identify the main goal in Node.js apps

   It protects the app by limiting requests per time window, avoiding abuse.

3. Final Answer:

   To control the number of requests a user can make in a set time -> Option C

4. Quick Check:

   Rate limiting = request control [OK]

Hint: Rate limiting controls request count per time window [OK]

Common Mistakes:

• Confusing rate limiting with speeding up server
• Thinking it stores user data
• Assuming it restarts the server automatically

2. Which of the following is the correct way to import the express-rate-limit middleware in a Node.js app?

easy

A. require rateLimit from 'express-rate-limit';

B. const rateLimit = require('express-rate-limit');

C. const rateLimit = import('express-rate-limit');

D. import rateLimit from 'express-rate-limit';

Solution

1. Step 1: Identify import syntax in Node.js

   Node.js commonly uses CommonJS syntax with const rateLimit = require('express-rate-limit'); unless using ES modules.

2. Step 2: Check each option for syntax correctness

   const rateLimit = require('express-rate-limit'); uses correct CommonJS require syntax; import rateLimit from 'express-rate-limit'; is ES module syntax which requires specific setup.

3. Final Answer:

   const rateLimit = require('express-rate-limit'); -> Option B

4. Quick Check:

   CommonJS require = const rateLimit = require('express-rate-limit'); [OK]

Hint: Use require() in CommonJS Node.js projects [OK]

Common Mistakes:

• Using ES module import without setup
• Trying to import asynchronously with import()
• Incorrect require syntax without parentheses

3. Given this code snippet using express-rate-limit, what will happen if a client sends 6 requests within 10 seconds?

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 10000, // 10 seconds
  max: 5
});

app.use(limiter);

medium

A. Only the first 5 requests will be accepted; the 6th will be blocked

B. All 6 requests will be accepted

C. Only the last request will be accepted

D. The server will crash after 5 requests

Solution

1. Step 1: Understand the rate limit settings

   The limiter allows max 5 requests per 10 seconds per client.

2. Step 2: Analyze client requests count

   Client sends 6 requests in 10 seconds; first 5 pass, 6th exceeds limit and is blocked.

3. Final Answer:

   Only the first 5 requests will be accepted; the 6th will be blocked -> Option A

4. Quick Check:

   Max 5 requests = 6th blocked [OK]

Hint: Requests over max in window get blocked [OK]

Common Mistakes:

• Assuming all requests pass
• Thinking only last request passes
• Believing server crashes on limit

4. Identify the error in this rate limiting middleware setup:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 'one minute',
  max: 10
});

app.use(limiter);

medium

A. windowMs should be a number, not a string

B. max should be a string, not a number

C. rateLimit must be called with parentheses

D. app.use cannot accept middleware

Solution

1. Step 1: Check windowMs type requirement

   windowMs expects a number representing milliseconds, not a string.

2. Step 2: Identify the error in the code

   windowMs is given as 'one minute' (string), which causes incorrect behavior or error.

3. Final Answer:

   windowMs should be a number, not a string -> Option A

4. Quick Check:

   windowMs type = number [OK]

Hint: windowMs must be a number, not quoted string [OK]

Common Mistakes:

• Passing windowMs as string
• Confusing max type
• Thinking app.use can't use middleware

5. You want to apply rate limiting only to API routes starting with /api/ in your Express app. Which code snippet correctly applies the limiter only to those routes?

hard

A. app.use('/api/', limiter);

B. app.use(limiter);

C. app.use('/api/*', limiter);

D. app.use('/api', limiter);

Solution

1. Step 1: Understand Express route prefix matching

   Using app.use('/api', limiter); applies middleware to all routes starting with '/api'.

2. Step 2: Evaluate other options

   app.use('/api', limiter); correctly applies limiter to all routes starting with '/api'. app.use('/api/', limiter); applies only to routes starting with '/api/' (with trailing slash), which may exclude '/api' itself.

3. Final Answer:

   app.use('/api', limiter); -> Option D

4. Quick Check:

   Prefix '/api' applies limiter correctly [OK]

Hint: Use app.use('/api', limiter) for route-specific limiting [OK]

Common Mistakes:

• Applying limiter globally by mistake
• Using invalid route patterns
• Confusing trailing slash effects