71-Nodejs Course 2023: Request Throttle, Rate Limiters and DDOS Attacks
Tags: node, typescript, mongodb, fastify
Published: 2022-11-26 13:43:12

---
title: 71-Nodejs Course 2023: Request Throttle, Rate Limiters and DDOS Attacks
published: true
description: 
series: Nodejs Course 2023
tags: nodejs, typescript, mongodb, fastify
cover_image: https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7x1n9kigdou5h40zewep.png
# Use a ratio of 100:42 for best results.
---

## Introduction

You may (or may not) have come across the keyword `throttle` or `rate-limit` in the context of Nodejs, but what does it mean? In this article, we will learn about throttling and how to implement it later in our code.

## What is throttling?

Throttling is a technique used to limit the number of requests that can be made to a server in a given time period. It is used to prevent a server from being overloaded by too many requests. It is also used to prevent a server from being attacked by a bot, that attack is called `DDoS` (Distributed Denial of Service) attack.

## What is DDOS attack?

Let’s back up for a second. What is a DDoS attack? *`DDoS` stands for `“distributed denial of service`”, which is a type of cyberattack that forces people offline. Hackers’ goals in committing DDoS attacks are to flood a network with unwanted requests and traffic. Subsequently, a site can’t handle the influx any further, preventing legitimate traffic from coming through.

## How does this work?

Let's say we have a server that is handling requests from a client. The client is making requests to the server at a rate of 100 requests per second. If we don't have any throttling mechanism, the server will be overloaded and will not be able to handle the requests thus the server will get crashed. So, we need to limit the number of requests that can be made to the server in a given time period. Let's say we limit the number of requests to 10 per second. So, the client will be able to make 10 requests per second and the server will be able to handle the requests.

We can refer to it as well as a `rate limiter`.

> This is a kind of middleware, don't forget that as it interacts with the request before it reaches the route handler.

## How to implement throttling?

We can do it by our own, but i'll use for now [Fastify-rate-limit](https://github.com/fastify/fastify-rate-limit) plugin to achieve this easily.

## Installing Fastify-rate-limit

Open up your terminal and run the following command to install the plugin.

```bash
yarn add @fastify/rate-limit
```

## Using Fastify-rate-limit

We already have the `plugins.ts` file in our `http` directory, so we can just call the plugin from there.

```ts
// src/core/http/plugins.ts
import fastifyJwt from "@fastify/jwt";
import fastifyMultipart from "@fastify/multipart";
import { registerPlugin } from "./server";

// Note the change that we made in the function definition, i added `async` keyword
export default async function registerHttpPlugins() {
  // 👇🏻 register rate-limit plugin
  await registerPlugin(import("@fastify/rate-limit"), {
    // max requests per time window
    max: 100,
    // maximum time that is will allow max requests
    timeWindow: "1 minute",
  });

  // import multipart plugin
  registerPlugin(fastifyMultipart, {
    attachFieldsToBody: true,
  });

  // use the jwt plugin with your preferred secret key
  registerPlugin(fastifyJwt, {
    secret: "my-secret",
  });
}
```

Actually i didn't know until this very moment that we can use `import()` in the `registerPlugin` function. I thought we can only use `require()` there or `static import`. But it turns out that we can use `import()` there as well, this will help us later to control which plugins to be used based on our later `http` configurations upgrade.

So we registered our plugin, and defined our `max` and `timeWindow` options, as using the plugin directly in the server instance, we don't need a middleware for that, but we can manage it later to be a good middleware too.

But to make this works, we need also tm `await` our `registerHttpPlugins` function in the `src/core/http/connectToServer.ts` file.

```ts
// src/core/http/connectToServer.ts
import config from "@mongez/config";
import router from "core/router";
import registerHttpPlugins from "./plugins";
import response from "./response";
import { getServer } from "./server";

export default async function connectToServer() {
  const server = getServer();

  // 👇🏻 await the registerHttpPlugins function
  await registerHttpPlugins();

  // call reset method on response object to response its state
  server.addHook("onResponse", response.reset.bind(response));

  router.scan(server);

  try {
    // 👇🏻 We can use the url of the server
    const address = await server.listen({
      port: config.get("app.port"),
      host: config.get("app.baseUrl"),
    });

    console.log(`Start browsing using ${address}`);
  } catch (err) {
    console.log(err);

    server.log.error(err);
    process.exit(1); // stop the process, exit with error
  }
}
```

## Testing the plugin

Let's test our plugin, let's decrease the `max` value to `10` and now let's write a little script to test our plugin.

We'll use it with our `/users` route but we'll need to stop the middleware now so we can test this in our browser.

> Don't forget to comment the middleware in `src/config/http` file.

Now open your browser, then Press `F12` or `Ctrl + Shift + I` to open the developer tools, then go to the `console` tab, then paste the following code.

  ```ts
async function main() {
  for (let i = 0; i < 20; i++) {
    try {
      const res = await fetch("http://localhost:3000/users");
      const content = await res.json();
      console.log('#' + i, content);
    } catch (err) {
      console.log(err);
    }
  }
}

main();
```

Now you should see the following output in your console.

![Throttling](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uupj36579iow4mkqr7zt.png)

And that's it.

## Will throttling prevent DDOS attacks?

No, it will not. Throttling will only prevent the server from being overloaded by too many requests. It will not prevent the server from being attacked by a bot, the idea here is to blacklist the IP address of the bot, so that it cannot send any more requests to the server.

## What if the bot uses a proxy or a VPN?

If the bot uses a proxy or a VPN, then it will have a different IP address, so it will not be blacklisted. The only way to prevent the bot from sending requests to the server is to use a captcha, which is a challenge-response test that is used to determine whether the user is human or not.

## A New Security Risks course on the way

Actually, i'm going to make a new series that will introduce variant types of attacks and how to make your code more secure against them, such as top 10 security vulnerabilities which are [called OWASP Top 10](https://owasp.org/www-project-top-ten/), and how to prevent them, and how to make your code more secure against them, the top `2021` security risks are:

1. [Broken Access Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)
2. [Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)
3. [Injection](https://owasp.org/Top10/A03_2021-Injection/)
4. [Insecure Design](https://owasp.org/Top10/A04_2021-Insecure_Design/)
5. [Security Misconfiguration](https://owasp.org/Top10/A05_2021-Security_Misconfiguration/)
6. [Vulnerable and Outdated Components](https://owasp.org/Top10/A06_2021-Vulnerable_and_Outdated_Components/)
7. [Identification and Authentication Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)
8. [Software and Data Integrity Failures](https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/)
9. [Security Logging and Monitoring Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/)
10. [Server Request Forgery](https://owasp.org/Top10/A10_2021-Server_Request_Forgery/)

This list will be demonstrated later in our new course, we'll start with a basic introduction to security risks and concepts such as:

* What is a security risk?
* What is a vulnerability?
* What is a threat?
* What is a risk?
* What is a security risk assessment?
* What is a security risk management?
* What is a security risk analysis?
* What is a security risk mitigation?
* What is a security risk treatment?
* What is a security risk assessment report?

Then we'll go with simple and very common security risks such as:

* Brute force attacks
* SQL injection
* Cross-site scripting (XSS)
* Cross-site request forgery (CSRF)
* DoS Attacks (Denial of Service) and DDoS Attacks (Distributed Denial of Service)
* Clickjacking
* Backdoors
* Buffer overflow
* Command injection
* Cookie poisoning
* Directory traversal
* Exploits
* Honey pots
* Man In The Middle (MITM)
* Phishing
* Session hijacking
* Spoofing
* Trojans
* Vulnerabilities
* Worms
* Zero-day attacks
* Zero-day vulnerabilities

We'll also learn how to use `VPN` cloud services such as [Cloudflare](https://www.cloudflare.com/) to protect our servers from attacks.

And more, **Stay tuned!**

## 🎨 Conclusion

In this article, we learned about `throttling` and `rate-limit` concepts and how to implement it in our code. We used the `@fastify/rate-limit` plugin to achieve this easily.

We can later make it more configurable either in the `config` file or in middlewares or even in each route.

## ☕♨️ Buy me a Coffee ♨️☕

If you enjoy my articles and see it useful to you, you may [buy me a coffee](https://www.paypal.com/paypalme/hassanzohdy), it will help me to keep going and keep creating more content.

## 🚀 Project Repository

You can find the latest updates of this project on [Github](https://github.com/hassanzohdy/nodejs-2023)

## 😍 Join our community

Join our community on [Discord](https://discord.gg/pb2vmdfhGf) to get help and support (Node Js 2023 Channel).

## 🎞️ Video Course (Arabic Voice)

If you want to learn this course in video format, you can find it on [Youtube](https://www.youtube.com/playlist?list=PLGO8ntvxgiZMJc7RN2lIq9WmMOlWZGzmz), the course is in Arabic language.

## 📚 Bonus Content 📚

You may have a look at these articles, it will definitely boost your knowledge and productivity.

General Topics

* [Event Driven Architecture: A Practical Guide in Javascript](https://dev.to/hassanzohdy/event-driven-architecture-the-best-paradigm-that-i-love-to-work-with-in-javascript-and-node-js-1gnk)
* [Best Practices For Case Styles: Camel, Pascal, Snake, and Kebab Case In Node And Javascript](https://dev.to/hassanzohdy/best-practices-for-case-styles-camel-pascal-snake-and-kebab-case-in-node-and-javascript-55oi)
* [After 6 years of practicing MongoDB, Here are my thoughts on MongoDB vs MySQL
](https://dev.to/hassanzohdy/after-6-years-of-practicing-mongodb-here-are-my-thoughts-on-mongodb-vs-mysql-574b)

Packages & Libraries

* [Collections: Your ultimate Javascript Arrays Manager](https://dev.to/hassanzohdy/collections-your-ultimate-javascript-array-handler-3o15)
* [Supportive Is: an elegant utility to check types of values in JavaScript](https://dev.to/hassanzohdy/supportive-is-an-elegant-utility-to-check-types-of-values-in-javascript-1b3e)
* [Localization: An agnostic i18n package to manage localization in your project](https://dev.to/hassanzohdy/mongez-localization-the-simplest-way-to-translate-your-website-regardless-your-favorite-framework-4gi3)

 React Js Packages

* [useFetcher: easiest way to fetch data in React Js](https://dev.to/hassanzohdy/usefetcher-the-easiest-way-to-fetch-data-in-react-45o9)

Courses (Articles)

* [OOP In JS And TS From The Very Beginning](https://dev.to/hassanzohdy/jsts-oop-course-1-introduction-2ld)
* [ES6++: The Ultimate Guide to ES6 and Beyond](https://dev.to/hassanzohdy/es6-1-introduction-h3e)
* [React Js: Let"s Create File Manager With React Js and Node Js](https://dev.to/hassanzohdy/lets-create-a-file-manager-from-scratch-with-react-and-typescript-chapter-i-a-good-way-to-expand-your-experience-5g4k)