Request Rate Limiting

In this lesson, you will learn how to protect your Node.js backend from overload by implementing the Sliding Window algorithm to throttle incoming requests.

Why Fixed Windows Fail

You might be familiar with "Fixed Window" limiting, where you allow, for example, 100 requests per minute. However, this creates a vulnerability: a user can send 100 requests at the very end of minute one and another 100 at the very start of minute two. That is 200 requests in a split second, which can crash a service that was only meant to handle 100 per minute.

The Sliding Window Approach

The Sliding Window algorithm solves this by tracking individual request timestamps. Instead of resetting a counter at the top of the hour, we look at a rolling window of time (e.g., the last 60 seconds) relative to the exact moment a request arrives.

Imagine we want to limit a user to 5 requests per minute. We store an array of timestamps for that user. When a new request arrives:

1. We remove any timestamps in the array that are older than 60 seconds.
2. We check the length of the remaining array.
3. If the length is less than 5, we accept the request and add the current timestamp to the array.
4. If the length is 5, we reject the request with a 429 Too Many Requests status code.

Implementation Logic

Using a simple object to track users in memory (in production, you would typically use Redis for this), your middleware logic would look like this:

const requestLogs = {}; // Map of userIP -> [timestamps]

function rateLimiter(req, res, next) {
  const now = Date.now();
  const windowStart = now - 60000; // 60 seconds ago
  const userIP = req.ip;

  // Initialize or filter timestamps
  let timestamps = (requestLogs[userIP] || []).filter(ts => ts > windowStart);

  if (timestamps.length >= 5) {
    return res.status(429).send('Too Many Requests');
  }

  timestamps.push(now);
  requestLogs[userIP] = timestamps;
  next();
}

By filtering the window on every request, we ensure that the user’s "quota" is always evaluated against the precise, current span of time, smoothing out traffic spikes and preventing the "reset burst" vulnerability.

Key Takeaway: The Sliding Window algorithm provides superior protection by enforcing rate limits across a rolling timeframe rather than static, predictable blocks.