API Rate Limiting-Best Strategies in Node.js

In a world where bots and DDoS attacks are constant threats, leaving your API unprotected is like leaving your front door wide open in a storm. Whether it’s protecting against a malicious attack or simply ensuring one “noisy neighbor” doesn’t crash your server for everyone else, rate limiting is your first line of defense.

Here is a deep dive into the three most common algorithms used by giants like Stripe, GitHub, and Google to keep their systems secure and stable.

The Token Bucket Algorithms:

The Token Bucket is perhaps the most popular algorithm because it is elegant and handles “bursty” traffic gracefully.

How it works:

Imagine a bucket that holds a fixed number of tokens. Every time a user makes a request, they must “spend” one token. If the bucket is empty, the request is rejected.

• Refill Rate: Tokens are added back to the bucket at a constant rate (e.g., 2 tokens per second).
• The Benefit: It allows users to send a quick burst of requests if they haven’t used the API in a while, but eventually, they are throttled by the refill rate.

Implementation:

class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;       // Max tokens the bucket can hold
    this.tokens = capacity;         // Current tokens
    this.refillRate = refillRate;   // Tokens added per second
    this.lastRefill = Date.now();
  }
refill() {
    const now = Date.now();
    const elapsed = (now - this.lastRefill) / 1000;
    const tokensToAdd = elapsed * this.refillRate;

    // Ensure we don't exceed capacity
    this.tokens = Math.min(this.capacity, this.tokens + tokensToAdd);
    this.lastRefill = now;
  }
  allowRequest() {
    this.refill();
    if (this.tokens >= 1) {
      this.tokens -= 1;
      return true;
    }
    return false;
  }
}

2. Fixed Window Counter: Simple but Flawed

The Fixed Window algorithm is the easiest to implement. It divides time into fixed blocks (e.g., 1-minute windows).

How it works:

If your limit is 100 requests per minute, the counter resets exactly at the start of every new minute.

• The Downside: It suffers from “boundary spikes.” A user could send 100 requests at 10:00:59 and another 100 at 10:01:01. In just two seconds, they’ve doubled your allowed limit!

class FixedWindow {
  constructor(windowSizeInSeconds, limit) {
    this.windowSize = windowSizeInSeconds * 1000;
    this.limit = limit;
    this.startTime = Date.now();
    this.count = 0;
  }
allowRequest() {
    const now = Date.now();
    if (now - this.startTime > this.windowSize) {
      // Reset the window
      this.startTime = now;
      this.count = 1;
      return true;
    }
    if (this.count < this.limit) {
      this.count++;
      return true;
    }
    return false;
  }
}

3. Sliding Window Log: The Precision Choice

To fix the “boundary spike” problem of the Fixed Window, we use the Sliding Window.

How it works:

Instead of fixed blocks of time, this algorithm tracks the exact timestamp of every request. When a new request comes in, it “slides” the window back from the current time and filters out any requests that are now too old.

• The Benefit: It is extremely accurate. A user can never bypass the limit by timing their requests around a window reset.

class SlidingWindow {
  constructor(windowSizeInSeconds, limit) {
    this.windowSize = windowSizeInSeconds * 1000;
    this.limit = limit;
    this.requestTimestamps = [];
  }
allowRequest() {
    const now = Date.now();

    // Filter out timestamps that fall outside the current window
    this.requestTimestamps = this.requestTimestamps.filter(
      timestamp => now - timestamp <= this.windowSize
    );
    if (this.requestTimestamps.length < this.limit) {
      this.requestTimestamps.push(now);
      return true;
    }
    return false;
  }
}

Note: For most production systems, the Token Bucket is the industry standard for balancing performance and flexibility.