Files
What you'll learn
- Say what a rate limit defends against (credential stuffing, scraping, one client starving the rest) and what it does not (a distributed attack)
- Configure @nestjs/throttler with a ttl and a limit, bind ThrottlerGuard globally, and read the X-RateLimit headers it adds
- Tighten one route with @Throttle and exempt another with @SkipThrottle
- Explain what the counter is keyed on (the caller's address and the route) and why a proxy changes that
Press Run tests to start the app. Its log appears here.Graded endpoints
The right password, and the headers say what the login route allows: 2 per window, 1 left
A failed attempt counts: the guard runs before the handler, so it cannot know the outcome, which is the point
Past the login route's limit: 429 with the throttler's message, and a Retry-After header saying how long to wait
Exempt; no counting headers at all
Still exempt
Still exempt
A fourth call within the minute, more than the app-wide limit, and still 200: @SkipThrottle() means never counted
The app-wide limit applies to a route that says nothing: 3 per minute
Counting down
The last one allowed
Over the app-wide limit for this route and this caller
A different route has its own counter: the first POST is fine while GET /cats is exhausted
Its own counter too
And this one
Counted like any request; a 204 still carries the headers