Rate limiting in Node.js - Step-by-Step Execution

Concept Flow - Rate limiting

Request Received

↓

Check Request Count

↓

Count < Limit?

No→Reject Request: Too Many Requests

Yes↓

Process Request

↓

Update Request Count

↓

Wait for Time Window Reset

↩Back to Check Request Count

Each request is checked against a limit. If under limit, it processes and updates count. If over, it rejects. Counts reset after a time window.

Execution Sample

Node.js

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 60000, // 1 minute
  max: 3
});

const express = require('express');
const app = express();

app.use(limiter);

This code limits requests to 3 per minute per client.

Execution Table

Step	Request Number	Current Count	Condition (Count < Max?)	Action	Response
1	1	0	0 < 3 (Yes)	Process request, count=1	Allowed
2	2	1	1 < 3 (Yes)	Process request, count=2	Allowed
3	3	2	2 < 3 (Yes)	Process request, count=3	Allowed
4	4	3	3 < 3 (No)	Reject request	Too Many Requests
5	5	3	3 < 3 (No)	Reject request	Too Many Requests
6	Time window resets	0	-	Reset count to 0	-
7	6	0	0 < 3 (Yes)	Process request, count=1	Allowed

💡 Requests rejected once count reaches max until time window resets.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After Reset	After 6
count	0	1	2	3	3	0	1

Key Moments - 2 Insights

Why does the count not increase after reaching the max limit?

Once count reaches max (3), requests are rejected and count stays the same until the time window resets, as shown in steps 4 and 5 in the execution_table.

What happens when the time window resets?

The count resets to 0, allowing new requests to be processed again, as shown in step 6 and 7 in the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, what is the count value after processing the 3rd request?

A 3

B 2

C 1

D 0

💡 Hint

Check the 'Current Count' column at Step 3 in the execution_table.

At which step does the rate limiter start rejecting requests?

A Step 2

B Step 4

C Step 6

D Step 1

💡 Hint

Look for the first 'Reject request' action in the execution_table.

If the max limit was increased to 5, how would the response at Step 4 change?

A Count would reset

B Request would be rejected

C Request would be allowed

D No change

💡 Hint

Refer to the 'Condition (Count < Max?)' column and consider max=5 instead of 3.

Concept Snapshot

Rate limiting controls how many requests a client can make in a time window.
Use a counter to track requests.
If count < max, allow and increment count.
If count >= max, reject requests.
Reset count after time window expires.

Full Transcript

Rate limiting is a way to control how many requests a user can make to a server in a set time. When a request comes in, the server checks how many requests have been made recently. If the number is less than the allowed maximum, the request is processed and the count increases. If the number reaches the limit, new requests are rejected until the time window resets and the count goes back to zero. This helps protect servers from too many requests at once.

Practice

1. What is the main purpose of rate limiting in a Node.js application?

easy

A. To store user data securely

B. To speed up the server response time

C. To control the number of requests a user can make in a set time

D. To automatically restart the server on errors

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts how many requests a user can send to prevent overload.

2. Step 2: Identify the main goal in Node.js apps

   It protects the app by limiting requests per time window, avoiding abuse.

3. Final Answer:

   To control the number of requests a user can make in a set time -> Option C

4. Quick Check:

   Rate limiting = request control [OK]

Hint: Rate limiting controls request count per time window [OK]

Common Mistakes:

• Confusing rate limiting with speeding up server
• Thinking it stores user data
• Assuming it restarts the server automatically

2. Which of the following is the correct way to import the express-rate-limit middleware in a Node.js app?

easy

A. require rateLimit from 'express-rate-limit';

B. const rateLimit = require('express-rate-limit');

C. const rateLimit = import('express-rate-limit');

D. import rateLimit from 'express-rate-limit';

Solution

1. Step 1: Identify import syntax in Node.js

   Node.js commonly uses CommonJS syntax with const rateLimit = require('express-rate-limit'); unless using ES modules.

2. Step 2: Check each option for syntax correctness

   const rateLimit = require('express-rate-limit'); uses correct CommonJS require syntax; import rateLimit from 'express-rate-limit'; is ES module syntax which requires specific setup.

3. Final Answer:

   const rateLimit = require('express-rate-limit'); -> Option B

4. Quick Check:

   CommonJS require = const rateLimit = require('express-rate-limit'); [OK]

Hint: Use require() in CommonJS Node.js projects [OK]

Common Mistakes:

• Using ES module import without setup
• Trying to import asynchronously with import()
• Incorrect require syntax without parentheses

3. Given this code snippet using express-rate-limit, what will happen if a client sends 6 requests within 10 seconds?

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 10000, // 10 seconds
  max: 5
});

app.use(limiter);

medium

A. Only the first 5 requests will be accepted; the 6th will be blocked

B. All 6 requests will be accepted

C. Only the last request will be accepted

D. The server will crash after 5 requests

Solution

1. Step 1: Understand the rate limit settings

   The limiter allows max 5 requests per 10 seconds per client.

2. Step 2: Analyze client requests count

   Client sends 6 requests in 10 seconds; first 5 pass, 6th exceeds limit and is blocked.

3. Final Answer:

   Only the first 5 requests will be accepted; the 6th will be blocked -> Option A

4. Quick Check:

   Max 5 requests = 6th blocked [OK]

Hint: Requests over max in window get blocked [OK]

Common Mistakes:

• Assuming all requests pass
• Thinking only last request passes
• Believing server crashes on limit

4. Identify the error in this rate limiting middleware setup:

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 'one minute',
  max: 10
});

app.use(limiter);

medium

A. windowMs should be a number, not a string

B. max should be a string, not a number

C. rateLimit must be called with parentheses

D. app.use cannot accept middleware

Solution

1. Step 1: Check windowMs type requirement

   windowMs expects a number representing milliseconds, not a string.

2. Step 2: Identify the error in the code

   windowMs is given as 'one minute' (string), which causes incorrect behavior or error.

3. Final Answer:

   windowMs should be a number, not a string -> Option A

4. Quick Check:

   windowMs type = number [OK]

Hint: windowMs must be a number, not quoted string [OK]

Common Mistakes:

• Passing windowMs as string
• Confusing max type
• Thinking app.use can't use middleware

5. You want to apply rate limiting only to API routes starting with /api/ in your Express app. Which code snippet correctly applies the limiter only to those routes?

hard

A. app.use('/api/', limiter);

B. app.use(limiter);

C. app.use('/api/*', limiter);

D. app.use('/api', limiter);

Solution

1. Step 1: Understand Express route prefix matching

   Using app.use('/api', limiter); applies middleware to all routes starting with '/api'.

2. Step 2: Evaluate other options

   app.use('/api', limiter); correctly applies limiter to all routes starting with '/api'. app.use('/api/', limiter); applies only to routes starting with '/api/' (with trailing slash), which may exclude '/api' itself.

3. Final Answer:

   app.use('/api', limiter); -> Option D

4. Quick Check:

   Prefix '/api' applies limiter correctly [OK]

Hint: Use app.use('/api', limiter) for route-specific limiting [OK]

Common Mistakes:

• Applying limiter globally by mistake
• Using invalid route patterns
• Confusing trailing slash effects