Designing a Scalable API Rate Limiter in Node.js Application
Tags: showdev, webdev, tutorial, beginners
Published: 2019-10-02 19:09:59

---
title: Designing a Scalable API Rate Limiter in Node.js Application
published: true
description: Designing a Scalable API Rate Limiter in Node.js Application
tags: showdev,webdev,tutorial,beginners
canonical_url: https://cloudnweb.dev/2019/10/designing-a-scalable-api-rate-limiter-in-node-js-application/
---
<!-- wp:paragraph -->
<p>In this article, we will see how to build a scalable rate limiter for API in Node.js Application. Building a Scalable API Rate Limiter in Node.js Application.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4>Scenario 1:</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Let's say, you are building a Public API Service where user can access the Service using that API. Meanwhile, you need to protect from <strong><a href="https://www.cloudflare.com/en-in/learning/ddos/what-is-a-ddos-attack/">DDOS Attack</a> </strong>of that Public API Service. </p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4>Scenario 2:</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Consider that we built a Product. we need to provide free trial to the users to access the Product service.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4>Solution:</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>On both the scenarios, <strong>Rate limiting Algorithm</strong> is a way to solve the Problems.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3> <strong>Rate limiting Algorithm</strong> :</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Firstly, Rate limiting algorithm is a way to limit the access to API's. For example, Let's say that an user request a API in the rate of <strong>100 Requests/Second</strong>. it might cause of the problem of server overload. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>To avoid this problem, we can limit the access to the API's. Like, <strong>20 Requests/minute</strong> for an user.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>Different Rate Limit Algorithm:</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Let's see type of rate limiting algorithms in software application development:</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4>Token Bucket:</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>it stores the maximum number of token it can provides for a requests per minute. For Example, For an user, API Rate limiter sets 5 tokens per minute. so, user can send maximum 5 requests to  server  per minutes. After that, server drops the request.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Mainly,Redis is used to store the information for fast access of the request data.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1432} -->
<figure class="wp-block-image"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/token_bucket.png" alt="" class="wp-image-1432"/></figure>
<!-- /wp:image -->

<!-- wp:heading {"level":4} -->
<h4>How it works</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Let's say <strong>User1</strong> sends request to server. server checks whether the request time and previous request time is greater than a minute. if it is less than a minute, it will check the token remaining for the specified user.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>If it is Zero, Server drops the request.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>Leaky Bucket</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>It is a Queue which takes request in <strong>First in First Out(FIFO)</strong> way. </p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":1435,"align":"center"} -->
<div class="wp-block-image"><figure class="aligncenter"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/leaky_bucket-1.png" alt="" class="wp-image-1435"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Once, Queue is filled. server drops the upcoming request until the queue has space to take more request.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>For Example, Server gets request 1,2,3 and 4.  Based on the Queue size. it takes in the request. consider the size of queue as 4. it will take requests 1,2,3 and 4. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>After that, server gets request 5. it will drop it. </p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>Fixed window Counter</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>it increments the request counter of an user for  a particular time. if counter crosses a threshold. server drops the request. it uses redis to store the request information.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>For example, Server gets the request from an user. if the user request info is present in redis and request time is less than the time of previous request,  it will increment the counter. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Once, the threshold is reached. server drops the upcoming request for a specified time.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4>Cons</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Let's say that server gets lots of request at 55th second of a minute. this won't work as expected</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>Sliding Logs</h3>
<!-- /wp:heading -->

<!-- wp:image {"id":1440,"align":"center"} -->
<div class="wp-block-image"><figure class="aligncenter"><img src="https://cloudnweb.dev/wp-content/uploads/2019/10/sliding_logs.png" alt="" class="wp-image-1440"/></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>it stores the logs of each request with a timestamp in redis or in memory. For each request, it will check the count of logs available for an user for a minute.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> further, if the count is more than the threshold, server drops the upcoming requests.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>On the other hand, there are few disadvantages with this approach. let's say if application receives  million request, maintaining log for each request in memory is expensive.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>Sliding window counter</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>This approach is somewhat similar to sliding logs. Only difference here is, Instead of storing all the logs,we store by grouping user request data based on timestamp.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>For example, Once server receives a request by an user. we check the memory for the request timestamp. if it is available, we increment the counter of it. if it is not available, we insert it as new record.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> In that way, we don't need to store  each request as a separate entry , we can group them by timestamp and maintain a counter for it.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":3} -->
<h3>Implmenting Sliding window Counter in Node.js App</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Complete source code can be found <a href="https://github.com/ganeshmani/nodejs-ratelimiter">here</a></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4>Prerequisites</h4>
<!-- /wp:heading -->

<!-- wp:list -->
<ul><li><a href="https://nodejs.org/en/download/">Node.js</a></li><li><a href="https://redis.io/download">Redis</a></li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>create a directory and initialize package.json using the following command</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>npm init --yes</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>After that, Install Express and redis for the application using the following command</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>npm i express redis moment</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Redis Client is used to connect with redis server. <a href="https://momentjs.com/docs/">moment </a>is used for storing the request timestamp.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Firstly, create a file <strong>server.js</strong> and add the following code.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>const express = require('express');
const rateLimiter = require('./slidingWindowCounter');
const app = express();

const router = express.Router();

router.get('/',(req,res) => {
    res.send('&lt;h1>API response&lt;/h1>')
})

app.use(rateLimiter);
app.use('/api',router);

app.listen(5000,() => {
    console.log('server is running on port 5000');
})</code></pre>
<!-- /wp:code -->

<!-- wp:paragraph -->
<p>Secondly, create a file <strong>slidingWindowCounter.js</strong> and add the following code.</p>
<!-- /wp:paragraph -->

<!-- wp:code -->
<pre class="wp-block-code"><code>const redis = require('redis');
const moment = require('moment');
const redisClient = redis.createClient();

module.exports = (req,res,next) => {
    
    redisClient.exists(req.headers.user,(err,reply) => {
        if(err){
            console.log("problem with redis");
            system.exit(0);
        }

        if(reply === 1) {

            redisClient.get(req.headers.user,(err,redisResponse) => {
                let data = JSON.parse(redisResponse);
                
                let currentTime = moment().unix()
                let lessThanMinuteAgo = moment().subtract(1,'minute').unix();

                let RequestCountPerMinutes = data.filter((item) => {
                    return item.requestTime > lessThanMinuteAgo;
                })

                let thresHold = 0;

                RequestCountPerMinutes.forEach((item) => {
                    thresHold = thresHold + item.counter;
                })

                if(thresHold >= 5){

                    return res.json({ "error" : 1,"message" : "throttle limit exceeded" })

                }
                else{

                    let isFound = false;
                    data.forEach(element => {
                        if(element.requestTime) {
                            isFound = true;
                            element.counter++;
                        }
                    });
                    if(!isFound){
                        data.push({
                            requestTime : currentTime,
                            counter : 1
                        })
                    }
                  
                    redisClient.set(req.headers.user,JSON.stringify(data));

                    next();

                }
            })
        }
        else{
            let data = [];
            let requestData = {
                'requestTime' : moment().unix(),
                'counter' : 1
            }
            data.push(requestData);
            redisClient.set(req.headers.user,JSON.stringify(data));

            next();
        }
    })
}</code></pre>
<!-- /wp:code -->

<!-- wp:list -->
<ul><li>it checks if the user exists in redis memory, if exists, process further. if not, insert the user details with counter value and request timestamp.</li><li>If  user already exists, it will check if count of request within the last minute exceeds the threshold. if it exceeds, server drops the request.</li><li>If it does not exceeds, it will increment the counter if any timestamp matches. else, it will insert .</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Complete Source Code can be found <a href="https://github.com/ganeshmani/nodejs-ratelimiter">here</a></p>
<!-- /wp:paragraph -->
{% youtube qlQ5XSDFe9c  %}
<!-- wp:html -->
<a href="https://click.linksynergy.com/link?id=YIJ5oggSvpI&offerid=507388.1587718&type=2&murl=https%3A%2F%2Fwww.udemy.com%2Fadvanced-node-for-developers%2F"><IMG border=0 src="https://i.udemycdn.com/course/480x270/1587718_8fdf.jpg" ></a><IMG border=0 width=1 height=1 src="https://ad.linksynergy.com/fs-bin/show?id=YIJ5oggSvpI&bids=507388.1587718&type=2&subid=0" >
<!-- /wp:html -->