Skip to content

Conversation

@adarshdotdev
Copy link
Contributor

Description:
This PR implements global rate limiting for the backend API using @nestjs/throttler. The configuration is set to allow a maximum of 5 requests per second per IP address, helping to prevent abuse of dynamic endpoints.

Key changes:

  • Installed @nestjs/throttler as a backend dependency.
  • Configured ThrottlerModule in app.module.ts with limit: 5 and timeToLive: 1.
  • Registered ThrottlerGuard as a global guard to enforce rate limiting on all routes.

Testing:

  • Verified that after 5 rapid requests from the same IP within 1 second, subsequent requests receive a 429 Too Many Requests response.
  • Confirmed that public and protected endpoints are both rate-limited as expected.

screenshort
Screenshot 2025-07-16 143835

Closes: #10


Let me know if you want to add or change anything!

@g3Bg2
Copy link
Contributor

g3Bg2 commented Jul 16, 2025

@adarshdotdev

This PR looks good, but it adds the rate limiting globally to all the APIs internal API's as well. We need rate limiting for dynamic endpoints.

@adarshdotdev
Copy link
Contributor Author

To clarify:

  • I plan to apply rate limiting only to the dynamic endpoints handled by DynamicController (/api/* in apps/backend/src/dynamic/dynamic.controller.ts) using the @Throttle decorator.
  • Other endpoints (e.g., admin, auth, etc.) will not be rate-limited.

confirm if this matches expectation before proceed.

@g3Bg2
Copy link
Contributor

g3Bg2 commented Jul 18, 2025

No, you’re applying the @Throttle decorator in dynamic.controller.ts.

Can you check again? Also, you can see that you’re applying rate limiting to other endpoints, for example, localhost:3000/hello and localhost:3000/dyan/auth/me. in your own screenshort.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants