How do you implement API rate limiting per user or per IP in NestJS?

Q: How do you implement API rate limiting per user or per IP in NestJS?

// app.module.ts — configure multiple time windows @Module({ imports: [ ThrottlerModule.forRoot([ { name: 'short', ttl: 1000, limit: 5 }, // 5 req/sec { name: 'long', ttl: 60000, limit: 100 }, // 100 req/min ]), ], providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }], }) export class AppModule {} // Controller — override limits per route @Controller('auth') export class AuthController { // Stricter limit on login endpoint @Throttle({ default: { ttl: 30000, limit: 3 } }) @Post('login') login(@Body() dto: LoginDto) {} // Skip throttling entirely @SkipThrottle() @Get('health') health() {} } // Custom key generator — rate limit per user ID instead of IP @Injectable() export class UserThrottlerGuard extends ThrottlerGuard { protected async getTracker(req: Request): Promise { return (req as any).user?.id?.toString() ?? req.ip; } } Register ThrottlerGuard globally via APP_GUARD so all routes are protected by default. Define multiple time windows (short + long) to catch both burst and sustained abuse. Override getTracker() to rate limit per authenticated user ID — IP-based limits are easily bypassed behind proxies. @Throttle() at the route level overrides the global default — use for sensitive endpoints like login. @SkipThrottle() exempts health checks and public status endpoints from rate limiting.

Difficulty: 6/10

NestJS middleware, Guards & Interceptors, Distributed rate-limit store

Use @nestjs/throttler — the official rate limiting package. Register ThrottlerModule.forRoot() with TTL and limit arrays for multiple time windows, then register ThrottlerGuard globally via APP_GUARD. Override per-route limits with @Throttle() and skip specific routes with @SkipThrottle(). Extend ThrottlerGuard and override getTracker() to rate limit per user ID instead of IP.

ThrottlerModule setup with per-user rate limiting

Rate limiting best practices:

1
Register ThrottlerGuard globally via APP_GUARD so all routes are protected by default.
2

How do you implement API rate limiting per user or per IP in NestJS?

Difficulty: 6/10

NestJS middleware, Guards & Interceptors, Distributed rate-limit store

Use @nestjs/throttler — the official rate limiting package. Register ThrottlerModule.forRoot() with TTL and limit arrays for multiple time windows, then register ThrottlerGuard globally via APP_GUARD. Override per-route limits with @Throttle() and skip specific routes with @SkipThrottle(). Extend ThrottlerGuard and override getTracker() to rate limit per user ID instead of IP.

ThrottlerModule setup with per-user rate limiting

Rate limiting best practices:

1
Register ThrottlerGuard globally via APP_GUARD so all routes are protected by default.
2

How do you implement API rate limiting per user or per IP in NestJS?

How do you implement API rate limiting per user or per IP in NestJS?

Scenario Questions

Follow-up Questions