How do you implement rate limiting on a Next.js Route Handler without an external service?

Question

Accepted Answer

Rate limiting protects your Next.js Route Handlers from abuse by restricting the number of requests a client can make within a time window. Without external services like Redis or database dependencies, you can implement a simple in-memory rate limiter using JavaScript's Map to track request counts by IP address. This approach works well for single-server deployments and smaller applications where server restarts and memory limits aren't critical concerns. The fixed window counter algorithm is the simplest to implement. For each client IP, you store their request count and the timestamp of their first request within the current window. When a new request arrives, you check if the current time exceeds the window duration; if so, reset the counter. Then increment the count and compare against the limit. If exceeded, return a 429 Too Many Requests response. This algorithm can be implemented directly in your Route Handler logic or extracted as middleware for reuse. ```tsx
// lib/rate-limit.ts
interface RateLimitEntry {
  count: number;
  firstRequest: number;
}

export class RateLimiter {
  private requests: Map<string, RateLimitEntry>;
  private limit: number;
  private windowMs: number;

constructor(limit: number, windowMs: number) {
    this.requests = new Map();
    this.limit = limit;
    this.windowMs = windowMs;
  }

public isRateLimited(identifier: string): boolean {
    const now = Date.now();
    const entry = this.requests.get(identifier);

if (!entry) {
      // First request from this client
      this.requests.set(identifier, { count: 1, firstRequest: now });
      return false;
    }

if (now - entry.firstRequest > this.windowMs) {
      // Window expired, reset
      entry.count = 1;
      entry.firstRequest = now;
      this.requests.set(identifier, entry);
      return false;
    }

entry.count++;
    this.requests.set(identifier, entry);

return entry.count > this.limit;
  }

// Optional: Clean up old entries periodically
  public cleanup(): void {
    const now = Date.now();
    for (const [ip, entry] of this.requests.entries()) {
      if (now - entry.firstRequest > this.windowMs) {
        this.requests.delete(ip);
      }
    }
  }
}
``` ```tsx
// app/api/login/route.ts
import { NextRequest, NextResponse } from 'next/server';
import { RateLimiter } from '@/lib/rate-limit';

// Create a singleton instance for this route
// Note: This resets on server restart
const limiter = new RateLimiter(10, 60 * 1000); // 10 requests per minute

export async function POST(request: NextRequest) {
  // Get client IP from headers (handles proxies)
  const ip = request.headers.get('x-forwarded-for') || 
            request.headers.get('x-real-ip') || 
            'unknown';
  
  // Check rate limit
  if (limiter.isRateLimited(ip)) {
    return NextResponse.json(
      { error: 'Too many requests. Please try again later.' },
      { status: 429 }
    );
  }

// Handle the actual request
  try {
    const body = await request.json();
    // Process login logic here
    
    return NextResponse.json({ success: true });
  } catch (error) {
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
}
``` For applying rate limits across multiple Route Handlers, you can implement the rate limiter in Next.js middleware. This centralizes the logic and ensures consistent protection. The middleware runs before requests reach your Route Handlers, allowing early rejection of over-limit clients. You can configure different limits for different routes by examining the URL path. ```tsx
// middleware.ts
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';
import { RateLimiter } from '@/lib/rate-limit';

// Different limiters for different routes
const limiters = {
  '/api/login': new RateLimiter(5, 60 * 1000),      // 5 per minute
  '/api/register': new RateLimiter(3, 60 * 1000),   // 3 per minute
  '/api/search': new RateLimiter(30, 60 * 1000),    // 30 per minute
  'default': new RateLimiter(60, 60 * 1000)         // 60 per minute default
};

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl;
  
  // Only apply to API routes
  if (!pathname.startsWith('/api/')) {
    return NextResponse.next();
  }

return NextResponse.next();
}

export const config = {
  matcher: '/api/:path*',
};
``` IP detection: Behind proxies, use headers like x-forwarded-for to get the real client IP. Always validate and sanitize these headers to prevent spoofing. Memory management: In-memory maps grow over time. Implement cleanup ro

How do you implement rate limiting on a Next.js Route Handler without an external service?

Implement rate limiting on Route Handlers without external services using in-memory storage with a Map to track requests by IP, checking limits within a fixed time window and returning 429 responses when exceeded

How do you implement rate limiting on a Next.js Route Handler without an external service?

Implement rate limiting on Route Handlers without external services using in-memory storage with a Map to track requests by IP, checking limits within a fixed time window and returning 429 responses when exceeded

Scenario Questions

Follow-up Questions