Questions
5 of 25
1How do you build a reusable pagination and sorting query DTO that can be extended by feature-specific DTOs in NestJS?
2How do you use ClassSerializerInterceptor with @Exclude() and @Expose() to control response shape in NestJS?
3What versioning strategies does NestJS support and how do you enable versioning?
4How do you implement idempotency keys for POST requests to prevent duplicate operations in NestJS?
5How do you implement API rate limiting per user or per IP in NestJS?
6How do you handle raw body access for webhook signature verification in NestJS?
7How do you stream a large file or dataset as a response without loading it fully into memory in NestJS?
8How do you implement content negotiation so an endpoint returns JSON or CSV based on the Accept header in NestJS?
9How do you set a default version so unversioned requests are handled by a specific version in NestJS?
10How do you document DTO properties for Swagger and handle optional vs required fields in NestJS?
11How do you handle HATEOAS hypermedia links in NestJS REST responses?
12What decorators does NestJS provide for route parameters and how do they differ from query params?
13How do you handle a route where the param can be either a numeric ID or the literal string 'me' in NestJS?
14How do you handle multi-value query parameters (arrays) in NestJS?
15What is the difference between @Body(), @Body('field'), and using a full DTO class in NestJS?
16How do you implement a PATCH endpoint correctly with partial validation using PartialType in NestJS?
17How do you implement discriminated union body validation where the DTO shape depends on a type field in NestJS?
18How do you set HTTP status codes, response headers, and redirects in NestJS without using @Res()?
19What is the recommended file structure for versioned controllers in a NestJS project?
20How do wildcard and optional route segments work in NestJS?
21What is the difference between @Param('id') and @Param() with no argument in NestJS?
22How do you extract and type query parameters in NestJS including optional ones with defaults?
23How do you implement a standard paginated response envelope across all list endpoints in NestJS?
24How do you apply versioning at controller and method level in NestJS and how do you mark a route as version-neutral?
25How do you set up Swagger in a NestJS application and annotate your controllers?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
05 / 25

How do you implement API rate limiting per user or per IP in NestJS?

Difficulty: 6/10
NestJS middleware, Guards & Interceptors, Distributed rate-limit store

Use @nestjs/throttler — the official rate limiting package. Register ThrottlerModule.forRoot() with TTL and limit arrays for multiple time windows, then register ThrottlerGuard globally via APP_GUARD. Override per-route limits with @Throttle() and skip specific routes with @SkipThrottle(). Extend ThrottlerGuard and override getTracker() to rate limit per user ID instead of IP.

ThrottlerModule setup with per-user rate limiting
Rate limiting best practices:
  1. 1

    Register ThrottlerGuard globally via APP_GUARD so all routes are protected by default.

  2. 2

    Define multiple time windows (short + long) to catch both burst and sustained abuse.

  3. 3

    Override getTracker() to rate limit per authenticated user ID — IP-based limits are easily bypassed behind proxies.

  4. 4

    @Throttle() at the route level overrides the global default — use for sensitive endpoints like login.

  5. 5

    @SkipThrottle() exempts health checks and public status endpoints from rate limiting.

Scenario Questions

0-2 years experience

  1. 1We have a simple NestJS controller that returns a list of products. How would you add a per‑IP rate limit of 100 requests per hour to this endpoint?
  2. 2If you used NestJS's built‑in ThrottlerModule but forgot to register it globally, what would happen when a client exceeds the limit?
  3. 3Can you walk me through where in the request lifecycle you would place the rate‑limiting logic in a NestJS app?

2-5 years experience

  1. 1Our service uses Redis to share rate‑limit counters across multiple instances. Describe how you would integrate Redis with NestJS's throttling mechanism, and what issues you might run into.
  2. 2During a load test, some users reported being blocked even though they were under the limit. How would you debug the rate‑limiting implementation in NestJS?
  3. 3We need to support both per‑user (based on JWT) and per‑IP limits on the same endpoint. How would you design the NestJS guards or interceptors to handle this without duplicating code?

5-8 years experience

  1. 1At scale we have dozens of NestJS microservices behind an API gateway. Discuss the trade‑offs between implementing rate limiting in each service versus centrally at the gateway, considering consistency, latency, and failure modes.
  2. 2Explain how you would handle burst traffic spikes while still enforcing a strict per‑user limit, and what changes you’d make to the NestJS rate‑limiting strategy.
  3. 3If the Redis store used for counters becomes unavailable, what fallback strategy would you implement in a NestJS application to avoid a total denial of service?

8+ years experience

  1. 1Our organization is migrating from a monolithic NestJS app to a distributed set of services, and we need a unified rate‑limiting policy across all services and external partners. Outline an architecture that allows policy changes without redeploying each service.
  2. 2How would you design a versioned rate‑limiting configuration system that lets product teams adjust limits per client tier, while ensuring backward compatibility and auditability across multiple NestJS services?
  3. 3Discuss the operational monitoring and alerting you’d put in place to detect misbehaving rate‑limit rules in a large‑scale NestJS deployment.

Follow-up Questions

  • What would you monitor to ensure the limits are working as expected?
  • How would you handle a situation where a legitimate client is mistakenly throttled?
  • Can you compare the performance impact of in‑memory versus an external store for rate limiting?
Share

Share via WhatsApp, X, Facebook, LinkedIn or copy link. Open Graph preview enabled.