Build a rate limiting middleware that restricts the number of requests a client can make within a specified time window, protecting your API from abuse.

Project Checklist

• Create middleware that tracks request counts per IP
• Implement sliding window or fixed window rate limiting
• Add configurable limits (requests per minute/hour)
• Return appropriate HTTP status codes (429 Too Many Requests)
• Include rate limit headers in responses
• Store rate limit data in memory or Redis

Bonus Project Checklist Items

• Implement different limits for different endpoints
• Add user-based rate limiting (authenticated users)
• Create whitelist/blacklist functionality
• Implement distributed rate limiting with Redis
• Add rate limit bypass for admin users
• Create rate limit analytics dashboard

Inspiration (Any companies/libraries similar)

• express-rate-limit
• API Gateway rate limiting
• Cloudflare rate limiting

Hint/Code snippet to start

const rateLimit = {};

function createRateLimiter(maxRequests, windowMs) {
  return (req, res, next) => {
    const ip = req.ip;
    const now = Date.now();

    if (!rateLimit[ip]) {
      rateLimit[ip] = { count: 1, resetTime: now + windowMs };
      return next();
    }

    if (now > rateLimit[ip].resetTime) {
      rateLimit[ip] = { count: 1, resetTime: now + windowMs };
      return next();
    }

    if (rateLimit[ip].count >= maxRequests) {
      return res.status(429).json({ error: 'Too many requests' });
    }

    rateLimit[ip].count++;
    next();
  };
}