Original subtitles

In this lecture let's implement rate limiting

in order to prevent the same IP

from making too many requests to our API

and that will then help us preventing attacks

like denial of service, or brute force attacks.

So, that rate limiter will be implemented

as a global middleware function.

So, basically, what the rate limiter is gonna do,

is to count the number of requests coming from one IP

and then, when there are too many requests,

block these requests, okay?

And so it makes sense to implement that

in a global middleware, so, we do that in app.js.

So, we haven't used this one in a long time,

and the rate limiter that we're going to use

is an npm package called Express Rate Limit.

So lets install that.

npm i express-rate-limit, alright.

And then, here at the top of our application,

let's call it rateLimit and then require

the express and actually it's already here

So VS code grabs this name from our package.json file.

Okay, and this name that I gave it here

usually comes from the documentation.

So if they do it like this in the documentation,

well, then that's the way that I follow as well.

Okay, so let's now use this middleware

right here at the top of our global middlewares,

let's actually write that here, global.

And we start by creating a limiter.

So limiter, and we do that by calling

the rateLimit function that we just defined up there.

So rateLimit is a function which receives

an object of options, okay?

And in here, we can basically define

how many requests per IP we are going to allow

in a certain amount of time.

So we can specify the max property,

which I'm gonna set to 100, and then also the window,

so the time window, okay?

So what I want to allow here is basically,

100 requests per hour.

And this here actually called window milliseconds.

Okay, and so we want one hour so 60 minutes,

times 60 for seconds, times 1,000 for milliseconds.

Alright, so again, what this will do

is to allow 100 requests from the same IP in one hour.

Okay, and if that limit is then crossed

by a certain IP, they will get back an error message.

And here we can now specify that message.

Too many requests from this IP,

please try again in an hour, alright,

so we kind of need to find a balance

which works best for our application.

For example, if you're building an API,

which really needs a lot of requests for one IP,

then of course, this number here should be greater.

So don't just follow blindly what I just put here,

but really adapt it to your own application

so that you don't make it unusable

because of this limiter, all right?

Anyway, this limiter now here that we just created

is basically a middleware function okay?

So, rateLimit is a function which will,

based on our objects, create a middleware function,

which we now can use using app.use just like we did before.

And we can do it simply like this.

But what we actually want is to basically

limit access to our API route.

So, we can specify that here,

remember that we can do that with middleware.

And so, we basically want to apply this limiter

only to a slash API, okay?

And so that will then affect all of the routes

that basically start with this, your app

so forward slash API, great.

So let's go back to our main tab here.

Give it a save, and now let's actually try this

and let's do it here with the simplest one,

so get all tours, then here is our result

and now what I want to show you is these headers here.

So our rate limiter creates these two headers

so the RateLimit-Limit, and the RateLimit-Remaining, okay?

So we start with 100 just as we defined,

and now we have remaining, 99,

because we already did one request, right?

So what happens if we do one other one?

Let's do it with Get Tour, for example,

and there's no tour with that ID,

but that doesn't matter, what matters here

is that the remaining is now down to 98.

And if we try it again, then you'll see

it's even down further to 97 okay?

And actually down here, we also have the reset.

So basically the timestamp where it is resetted okay?

So that one hour window that we specified before.

Okay, now if in between this our app is restarted,

so in order to do that I will simply save.

Let's see what happens then, okay,

so I'm sending it again, and so now

we're back starting from the beginning basically.

Okay, so our app cannot crash during this time

because otherwise, that will basically then

reset the limit as well okay?

Now, let's actually try to see the error message,

and so I will take down this maximum to just three okay?

And save it here, send this request,

and in our headers we now see

we have only two remaining, let's try another one

and so now zero remaining, so this

probably was our last one, let's see the body,

so this time, we still got data,

but if we now try it again, we got an error.

Roo many requests from this IP.

And then it will automatically set

the status code to 429 which means too many requests.

Okay, and so again, this will help us try

to prevent denial of service and also brute force attacks

where an attacker tries to guess

the password of some user, basically by using

as the name says, brute force.

Okay, so that is API limiting,

quite straightforward to implement

with this Express Rate Limit package.