pn-rate-limiting

Rate limiting

When to use

• Protecting public or authenticated API endpoints from overuse
• Implementing per-user, per-IP, or per-API-key rate limits
• Adding abuse prevention to auth endpoints (login, password reset, OTP)
• Configuring edge-level rate limiting (Vercel, Cloudflare)
• Returning correct 429 Too Many Requests responses with Retry-After

Algorithm choice

Default recommendation: sliding window for API protection; token bucket for background jobs.

Redis sliding window (ioredis)

import { Redis } from "ioredis";

const redis = new Redis(process.env.REDIS_URL!);

interface RateLimitResult {
  allowed: boolean;
  remaining: number;
  resetAt: number; // Unix ms
}

async function rateLimit(
  key: string,
  limit: number,
  windowMs: number
): Promise<RateLimitResult> {
  const now = Date.now();
  const windowStart = now - windowMs;
  const redisKey = `rl:${key}`;

  const pipeline = redis.pipeline();
  pipeline.zremrangebyscore(redisKey, 0, windowStart); // remove old entries
  pipeline.zadd(redisKey, now, `${now}-${Math.random()}`); // add current request
  pipeline.zcard(redisKey);                               // count in window
  pipeline.pexpire(redisKey, windowMs);                   // auto-expire key

  const results = await pipeline.exec();
  const count = results?.[2]?.[1] as number ?? 0;

  return {
    allowed: count <= limit,
    remaining: Math.max(0, limit - count),
    resetAt: now + windowMs,
  };
}

// Middleware (Express)
export async function rateLimitMiddleware(req: Request, res: Response, next: NextFunction) {
  const key = `ip:${req.ip}`; // or `user:${req.user?.id}` for authenticated
  const result = await rateLimit(key, 100, 60_000); // 100 req / min

  res.setHeader("X-RateLimit-Limit", 100);
  res.setHeader("X-RateLimit-Remaining", result.remaining);
  res.setHeader("X-RateLimit-Reset", Math.ceil(result.resetAt / 1000));

  if (!result.allowed) {
    res.setHeader("Retry-After", Math.ceil((result.resetAt - Date.now()) / 1000));
    return res.status(429).json({ error: "Too many requests", retryAfter: result.resetAt });
  }
  next();
}