Build a rate limiting system that restricts the number of requests a client can make within a time window, preventing API abuse and ensuring service stability.

Project Checklist

• Implement token bucket or sliding window algorithm
• Create middleware that tracks requests per IP/user
• Add configurable rate limits (requests per minute/hour)
• Return appropriate HTTP status codes (429 Too Many Requests)
• Include rate limit headers in responses
• Support different limits for different endpoints

Bonus Project Checklist Items

• Use Redis for distributed rate limiting
• Implement different rate limits for authenticated vs anonymous users
• Add whitelist/blacklist functionality
• Create rate limit bypass for admin users
• Implement rate limit analytics and monitoring
• Add rate limit notifications/alerts

Inspiration (Any companies/libraries similar)

• express-rate-limit
• API Gateway rate limiting
• Cloudflare rate limiting

Hint/Code snippet to start

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per windowMs
  message: 'Too many requests from this IP'
});

app.use('/api/', limiter);

// Custom rate limiter
const strictLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 5
});

app.post('/api/login', strictLimiter, loginHandler);