Rate limiting in Node.js - Step-by-Step Execution

Concept Flow - Rate limiting

Request Received

↓

Check Request Count

↓

Count < Limit?

No→Reject Request: Too Many Requests

Yes↓

Process Request

↓

Update Request Count

↓

Wait for Time Window Reset

↩Back to Check Request Count

Each request is checked against a limit. If under limit, it processes and updates count. If over, it rejects. Counts reset after a time window.

Execution Sample

Node.js

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 3
});

const express = require('express');
const app = express();

app.use(limiter);

This code limits requests to 3 per minute per client.

Execution Table

Step	Request Number	Current Count	Condition (Count < Max?)	Action	Response
1	1	0	0 < 3 (Yes)	Process request, count=1	Allowed
2	2	1	1 < 3 (Yes)	Process request, count=2	Allowed
3	3	2	2 < 3 (Yes)	Process request, count=3	Allowed
4	4	3	3 < 3 (No)	Reject request	Too Many Requests
5	5	3	3 < 3 (No)	Reject request	Too Many Requests
6	Time window resets	0	-	Reset count to 0	-
7	6	0	0 < 3 (Yes)	Process request, count=1	Allowed

💡 Requests rejected once count reaches max until time window resets.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After Reset	After 6
count	0	1	2	3	3	0	1

Key Moments - 2 Insights

Why does the count not increase after reaching the max limit?

Once count reaches max (3), requests are rejected and count stays the same until the time window resets, as shown in steps 4 and 5 in the execution_table.

What happens when the time window resets?

The count resets to 0, allowing new requests to be processed again, as shown in step 6 and 7 in the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, what is the count value after processing the 3rd request?

A 3

B 2

C 1

D 0

💡 Hint

Check the 'Current Count' column at Step 3 in the execution_table.

At which step does the rate limiter start rejecting requests?

A Step 2

B Step 4

C Step 6

D Step 1

💡 Hint

Look for the first 'Reject request' action in the execution_table.

If the max limit was increased to 5, how would the response at Step 4 change?

A Count would reset

B Request would be rejected

C Request would be allowed

D No change

💡 Hint

Refer to the 'Condition (Count < Max?)' column and consider max=5 instead of 3.

Concept Snapshot

Rate limiting controls how many requests a client can make in a time window.
Use a counter to track requests.
If count < max, allow and increment count.
If count >= max, reject requests.
Reset count after time window expires.

Full Transcript

Rate limiting is a way to control how many requests a user can make to a server in a set time. When a request comes in, the server checks how many requests have been made recently. If the number is less than the allowed maximum, the request is processed and the count increases. If the number reaches the limit, new requests are rejected until the time window resets and the count goes back to zero. This helps protect servers from too many requests at once.