Basic API Rate Limiting in Node.js Express

const express = require('express');
const app = express();
const PORT = process.env.PORT || 3000;

// In-memory store for rate limiting (for production, use Redis or similar)
const requestCounts = {};
const WINDOW_SIZE_MS = 60 * 1000; // 1 minute
const MAX_REQUESTS_PER_WINDOW = 5; // Max 5 requests per minute

/**
 * Simple rate limiting middleware
 * Limits requests based on IP address.
 * For production, use a more robust solution like 'express-rate-limit'
 * and a persistent store (Redis, Memcached).
 */
const rateLimitMiddleware = (req, res, next) => {
  // Use x-forwarded-for for production behind a proxy, otherwise req.ip
  const ip = req.headers['x-forwarded-for'] || req.ip;

  if (!requestCounts[ip]) {
    requestCounts[ip] = {
      count: 0,
      lastReset: Date.now()
    };
  }

  const client = requestCounts[ip];
  const currentTime = Date.now();

  // Reset count if window has passed
  if (currentTime - client.lastReset > WINDOW_SIZE_MS) {
    client.count = 0;
    client.lastReset = currentTime;
  }

  if (client.count >= MAX_REQUESTS_PER_WINDOW) {
    // Calculate how much time is left until reset
    const timeLeft = Math.ceil((client.lastReset + WINDOW_SIZE_MS - currentTime) / 1000);
    res.set('Retry-After', timeLeft); // Suggest client to retry after this many seconds
    return res.status(429).json({
      message: `Too many requests from this IP, please try again after ${timeLeft} seconds.`,
      retryAfter: timeLeft
    });
  }

  client.count++;
  next();
};

// Apply rate limiting to all API routes
app.use('/api', rateLimitMiddleware);

// Protected API endpoint
app.get('/api/data', (req, res) => {
  res.json({ message: 'This is some protected data!', timestamp: new Date() });
});

// Unprotected endpoint
app.get('/public', (req, res) => {
  res.json({ message: 'This is public data, no rate limit applies.' });
});

app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});