Rate Limiting

Express (express-rate-limit)

import rateLimit from 'express-rate-limit'; import RedisStore from 'rate-limit-redis'; import { createClient } from 'redis';

const redis = createClient({ url: process.env.REDIS_URL });

// Global rate limit const globalLimiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes limit: 100, standardHeaders: 'draft-7', legacyHeaders: false, store: new RedisStore({ sendCommand: (...args) => redis.sendCommand(args) }), message: { error: 'Too many requests, try again later' }, });

app.use(globalLimiter);

// Stricter limit on auth endpoints const authLimiter = rateLimit({ windowMs: 15 * 60 * 1000, limit: 5, keyGenerator: (req) => req.body.email || req.ip, // By email, not just IP store: new RedisStore({ sendCommand: (...args) => redis.sendCommand(args) }), });

app.use('/api/auth/login', authLimiter);

Redis Sliding Window (custom)

async function isRateLimited(key: string, limit: number, windowSec: number): Promise<boolean> { const now = Date.now(); const windowStart = now - windowSec * 1000;

const multi = redis.multi(); multi.zRemRangeByScore(key, 0, windowStart); // Remove old entries multi.zAdd(key, { score: now, value: ${now} }); multi.zCard(key); // Count in window multi.expire(key, windowSec);

const results = await multi.exec(); const count = results![2] as number; return count > limit; }

// Usage if (await isRateLimited(rl:${userId}, 100, 60)) { return res.status(429).json({ error: 'Rate limit exceeded' }); }

Algorithm Comparison

Algorithm Precision Memory Best For

Fixed window Low (burst at edges) Very low Simple APIs

Sliding window log High Medium Accurate limiting

Sliding window counter Medium Low Balance of accuracy & memory

Token bucket Medium Low Burst-friendly APIs

Spring Boot (Bucket4j)

@Bean public FilterRegistrationBean<RateLimitFilter> rateLimitFilter() { var filter = new RateLimitFilter( Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))) ); var registration = new FilterRegistrationBean<>(filter); registration.addUrlPatterns("/api/*"); return registration; }

Response Headers

// Standard rate limit headers (RFC draft-7) res.set({ 'RateLimit-Limit': '100', 'RateLimit-Remaining': ${remaining}, 'RateLimit-Reset': ${resetTimestamp}, 'Retry-After': ${retryAfterSeconds}, // On 429 responses });

Anti-Patterns

Anti-Pattern Fix

In-memory rate limiting in multi-server Use Redis-backed store

Rate limit by IP only Also limit by user ID or API key

No rate limit headers in response Send RateLimit-* headers for client awareness

Same limit for all endpoints Tighter limits on auth, webhooks, expensive ops

No Retry-After on 429 Include Retry-After header

Production Checklist

• Redis-backed rate limiting for distributed deployments

• Per-endpoint rate limit configuration

• Standard rate limit headers in responses

• Retry-After header on 429 responses

• Rate limit by user ID (not just IP)

• Monitoring: rate limit hit frequency