NestJS Request Rate Limit Tutorial 2023

There are a few different ways you can limit access rate in a NestJS application. One option is to use the @UseInterceptors decorator to apply an interceptor that can rate-limit requests.

For example, you can use the @UseInterceptors decorator in combination with the RateLimiterInterceptor from the @nestjs/microservices package to rate-limit requests to a particular controller or route.

Here's an example of how you might use the RateLimiterInterceptor:

import { Controller, Get, UseInterceptors } from '@nestjs/common';
import { RateLimiterInterceptor } from '@nestjs/microservices';

@Controller('users')
@UseInterceptors(RateLimiterInterceptor)
export class UserController {
  @Get()
  findAll() {
    // This route is rate-limited
  }
}

The RateLimiterInterceptor uses an in-memory store to track the number of requests made by each client within a specified time period. You can customize the rate-limiting behavior by providing options to the interceptor. For example:

@UseInterceptors(RateLimiterInterceptor({ limit: 10, duration: 60 }))

This will limit clients to a maximum of 10 requests per 60 seconds.

Another option for rate-limiting in NestJS is to use a third-party package like rate-limiter-flexible. This package provides a flexible, Redis-based rate-limiting solution that you can use with NestJS.

To use rate-limiter-flexible with NestJS, you will first need to install it as a dependency in your project:

npm install rate-limiter-flexible

Then, you can use the RateLimiterFlexible class from the package to rate-limit requests in your application. For example:

import { Controller, Get, HttpException, HttpStatus } from '@nestjs/common';
import { RateLimiterFlexible } from 'rate-limiter-flexible';

@Controller('users')
export class UserController {
  private readonly rateLimiter: RateLimiterFlexible;

  constructor() {
    this.rateLimiter = new RateLimiterFlexible({
      points: 10, // 10 requests
      duration: 1, // per 1 second by IP
    });
  }

  @Get()
  async findAll() {
    try {
      await this.rateLimiter.consume(request.ip);
      // Proceed with the request
    } catch (error) {
      throw new HttpException('Too Many Requests', HttpStatus.TOO_MANY_REQUESTS);
    }
  }
}

This example will limit clients to a maximum of 10 requests per second.