Rate limiting

A rate limit caps how many requests a client may make in a window, protecting login endpoints from guessing and the service from abuse. The limit key, per IP, per user or per API key, decides what it protects.

What a session covers

The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.

Explain what a rate limit protects and what the key decides
Add a rate limit to a login endpoint
Spot the limit keyed only on IP and explain who it blocks

In practice

A few lines that show Rate limiting doing its job.

JavaScript

import rateLimit from "@fastify/rate-limit";

await app.register(rateLimit, {
  max: 100,
  timeWindow: "1 minute",
  keyGenerator: (req) => req.user?.id ?? req.ip,
});

// stricter on login
app.post("/login", { config: { rateLimit: { max: 10, timeWindow: "1 minute" } } }, login);

The common mistake

Watch for

Keying every limit on the IP address. Office networks and mobile carriers put thousands of users behind one address, so the legitimate ones are blocked while an attacker rotates addresses.

What to know first

Your roadmap puts these before Rate limiting, unless you already know them.

Middleware

How it stays learned

Once a session shows you understand Rate limiting, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.

Day 3First recall, while it is fresh
Day 7Second, a week on
Day 18Last, when it has settled

Previous in the module← Input sanitisation