‫In this lecture let's implement rate limiting
‫in order to prevent the same IP
‫from making too many requests to our API
‫and that will then help us preventing attacks
‫like denial of service, or brute force attacks.
‫So, that rate limiter will be implemented
‫as a global middleware function.
‫So, basically, what the rate limiter is gonna do,
‫is to count the number of requests coming from one IP
‫and then, when there are too many requests,
‫block these requests, okay?
‫And so it makes sense to implement that
‫in a global middleware, so, we do that in app.js.
‫So, we haven't used this one in a long time,
‫and the rate limiter that we're going to use
‫is an npm package called Express Rate Limit.
‫So lets install that.
‫npm i express-rate-limit, alright.
‫And then, here at the top of our application,
‫let's call it rateLimit and then require
‫the express and actually it's already here
‫So VS code grabs this name from our package.json file.
‫Okay, and this name that I gave it here
‫usually comes from the documentation.
‫So if they do it like this in the documentation,
‫well, then that's the way that I follow as well.
‫Okay, so let's now use this middleware
‫right here at the top of our global middlewares,
‫let's actually write that here, global.
‫And we start by creating a limiter.
‫So limiter, and we do that by calling
‫the rateLimit function that we just defined up there.
‫So rateLimit is a function which receives
‫an object of options, okay?
‫And in here, we can basically define
‫how many requests per IP we are going to allow
‫in a certain amount of time.
‫So we can specify the max property,
‫which I'm gonna set to 100, and then also the window,
‫so the time window, okay?
‫So what I want to allow here is basically,
‫100 requests per hour.
‫And this here actually called window milliseconds.
‫Okay, and so we want one hour so 60 minutes,
‫times 60 for seconds, times 1,000 for milliseconds.
‫Alright, so again, what this will do
‫is to allow 100 requests from the same IP in one hour.
‫Okay, and if that limit is then crossed
‫by a certain IP, they will get back an error message.
‫And here we can now specify that message.
‫Too many requests from this IP,
‫please try again in an hour, alright,
‫so we kind of need to find a balance
‫which works best for our application.
‫For example, if you're building an API,
‫which really needs a lot of requests for one IP,
‫then of course, this number here should be greater.
‫So don't just follow blindly what I just put here,
‫but really adapt it to your own application
‫so that you don't make it unusable
‫because of this limiter, all right?
‫Anyway, this limiter now here that we just created
‫is basically a middleware function okay?
‫So, rateLimit is a function which will,
‫based on our objects, create a middleware function,
‫which we now can use using app.use just like we did before.
‫And we can do it simply like this.
‫But what we actually want is to basically
‫limit access to our API route.
‫So, we can specify that here,
‫remember that we can do that with middleware.
‫And so, we basically want to apply this limiter
‫only to a slash API, okay?
‫And so that will then affect all of the routes
‫that basically start with this, your app
‫so forward slash API, great.
‫So let's go back to our main tab here.
‫Give it a save, and now let's actually try this
‫and let's do it here with the simplest one,
‫so get all tours, then here is our result
‫and now what I want to show you is these headers here.
‫So our rate limiter creates these two headers
‫so the RateLimit-Limit, and the RateLimit-Remaining, okay?
‫So we start with 100 just as we defined,
‫and now we have remaining, 99,
‫because we already did one request, right?
‫So what happens if we do one other one?
‫Let's do it with Get Tour, for example,
‫and there's no tour with that ID,
‫but that doesn't matter, what matters here
‫is that the remaining is now down to 98.
‫And if we try it again, then you'll see
‫it's even down further to 97 okay?
‫And actually down here, we also have the reset.
‫So basically the timestamp where it is resetted okay?
‫So that one hour window that we specified before.
‫Okay, now if in between this our app is restarted,
‫so in order to do that I will simply save.
‫Let's see what happens then, okay,
‫so I'm sending it again, and so now
‫we're back starting from the beginning basically.
‫Okay, so our app cannot crash during this time
‫because otherwise, that will basically then
‫reset the limit as well okay?
‫Now, let's actually try to see the error message,
‫and so I will take down this maximum to just three okay?
‫And save it here, send this request,
‫and in our headers we now see
‫we have only two remaining, let's try another one
‫and so now zero remaining, so this
‫probably was our last one, let's see the body,
‫so this time, we still got data,
‫but if we now try it again, we got an error.
‫Roo many requests from this IP.
‫And then it will automatically set
‫the status code to 429 which means too many requests.
‫Okay, and so again, this will help us try
‫to prevent denial of service and also brute force attacks
‫where an attacker tries to guess
‫the password of some user, basically by using
‫as the name says, brute force.
‫Okay, so that is API limiting,
‫quite straightforward to implement
‫with this Express Rate Limit package.