Rate Limiting

Rate limiting — restrict request count per client to prevent abuse.

SecurityModerate

Stack Components

StrategyToken Bucket / Fixed Window

Why

Prevents DoS, brute force, API abuse, fair resource allocation. Verizon DBIR 2024: 68% of breaches involve human error.

Snyk and Dependabot scan 500k+ npm packages for CVEs, and OWASP Top 10 hasn't changed much — injection and broken auth remain #1 and #2.

When

Use for public APIs. Avoid for internal services.

How

1. Choose algorithm (token bucket/sliding window) 2. Set limits per route 3. Use Redis for distributed 4. Return 429 with Retry-After

Example

import rateLimit from 'express-rate-limit'; app.use('/api', rateLimit({ windowMs: 60000, max: 100 }));

Common Problems

⚠Memory store in multi-instance — use Redis store
⚠Legitimate users blocked — tune limits
⚠Configuration drift between environments — use infrastructure-as-code (Terraform/Pulumi) to keep dev/staging/prod identical

Best Practices

✓Use X-RateLimit headers
✓Apply stricter limits to auth endpoints
✓Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit

FAQ

What is Rate Limiting and what projects is it for?

Rate limiting — restrict request count per client to prevent abuse. It pairs layered technologies for end-to-end type safety and out-of-the-box deploys, fitting everything from MVPs to production SaaS.

How do I spin up a working demo with Rate Limiting in 10 minutes?

Two steps: (1) Choose algorithm (token bucket/sliding window); (2) Set limits per route. Get the local dev server running, then wire one real data source to verify the end-to-end loop.

What is the most common pitfall with Rate Limiting and how do I avoid it?

The most common pitfall is: Memory store in multi-instance — use Redis store. Avoid it by adding the matching checklist to your PR template and running type-check + lint + unit tests in CI — three gates before merge.

What are the best practices for Rate Limiting?

Best practices for Rate Limiting include: Use X-RateLimit headers; Apply stricter limits to auth endpoints; Set up health checks and graceful shutdown — handle SIGTERM to drain in-flight requests before exit. The first one — "Use X-RateLimit headers" — should be set up at project init to avoid costly rework later.

When should I NOT choose Rate Limiting?

Pick something else in three cases: (1) the team has zero experience with the core framework and the deadline is tight (learning-curve risk); (2) it's a pure content/marketing site (Astro is lighter); (3) you need very high throughput (>10k RPS) or strict-consistency microservices (Go/Rust). Rate Limiting shines for mid-to-high complexity full-stack and API work — don't over-engineer simple static pages with it.