NestJS Rate Limiting

Sometimes restrictions can be rewarding, as some would say "Less is more" and in the case of rate limiting, that's exactly what we're doing.

What is rate limiting?

Rate limiting is a technique used by web server developers to control the number of requests a client can make in a specific period of time. This helps us prevent certain attacks or abuse that could impact our server resources.

Rate limiting in NestJS

Just like any other backend framework, NestJS also allows rate limiting through multiple methods like using a middleware or plugins provided by various libraries. The main idea is simple, we need to track each incoming request, mainly by IP address or client ID, create a set of predefined rules to enforce a certain limit and allow the server to decide whether to allow or deny each incoming request and handle the responses of each request including the ones that exceeds the rate limit, the usual HTTP status code for this being code 429 Too Many Requests.

How to implement rate limiting

NestJS offers a package called @nestjs/throttler that can help us out. After installing it, the ThrottlerModule can be configured.

@Module({
  imports: [
    ThrottlerModule.forRoot([{
      ttl: 60000,
      limit: 10,
    }]),
  ],
})
export class AppModule {}

Let's break this code down based on the main idea described earlier.

1. Enforce a certain limit: this is done by the limit option inside the ThrottlerModule and it sets the maximum number of requests that a client can make within the time frame decided in ttl (Time To Live). The ttl is set in miliseconds so for the example above, we'll allow a maximum of 10 calls in a 1 minute timeframe for the routes of our applications that are guarded with the ThrottlerGuard.

2. Tracking each incoming request: In order to do this, we need to bind a guard and if we want to bind the guard globally we can do so by adding the provider to any module:

{
  provide: APP_GUARD,
  useClass: ThrottlerGuard
}

Why use rate limiting in your backend project?

The benefits of using rate limiting are multiple but the most important ones are:

1. Enhanced security by helping you protect against brute force attacks where an attacker might try to guess passwords or access restricted resources by making a large number of requests in a short period of time or even help mitigating DDoS attacks by limiting the number of requests an attacker can make within the given timeframe thus preventing the server from being overwhelmed by a flood of requests.

2. Improved performance is also a bonus added by rate limiting, helping maintaining optimal server performance and responsiveness. It ensures that the server can efficiently process legitimate requests from your users without being slowed down by unnecessary or even malicious traffic.

3. Resource conservation is a big plus as limiting the number of requests from a client can ensure a fair usage of server resources.

Let me know if there are any more questions related to this essential mechanism for maintaining the stability, security and perfomance of web servers especially for high-traffic or public-facing applications.