mediumSystem Design

How do you implement rate limiting in a Node.js Express application?

Q: How do you implement rate limiting in a Node.js Express application?

**TL;DR.** Cap how many requests a client can make in a time window using a middleware like express-rate-limit , backed by an **in-memory** store (single instance) or **Redis** (shared across instances). Common algorithms: **fixed window**, **sliding window**, and **token bucket**. Key by IP, API key, or user. requests limiter count per key/window <path class='d-edge-d

564 views

Understand the problem

Interviewers want to see how you protect APIs from abuse or brute-force attacks at the application level.

securityexpressmiddleware

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Stuck? AI Nudge Available

Get a conceptual hint to guide your logic without spoiling the final implementation.

Study the solution

The solution is waiting

Give it an honest attempt first — then compare your thinking with the full walkthrough.

Read the code

Redis-backed global limiter

import rateLimit from 'express-rate-limit';
import { RedisStore } from 'rate-limit-redis';

app.set('trust proxy', 1);   // behind a load balancer

app.use(rateLimit({
  store: new RedisStore({ sendCommand: (...a) => redis.call(...a) }),
  windowMs: 60_000,
  max: 100,                  // 100 req/min per IP, shared across instances
}));

Join the discussion

Discussion (0)

No responses yet. Be the first to share what you think.

What is the difference between an ORM, a query builder, and a raw driver?

How do you run TypeScript directly in Node.js (native type stripping, tsx, ts-node)?