How I rate limit without third party services

My Products

Useful Links

[IkraamDev]

The reason your videos are good is because it doesn’t feel like a normal YouTube tutorial, it feels like a co-worker showing you some cool tricks he came up with or how he solved an issue.

[magiczz]

I'm currently doing an internship for my Bachelor degree in Applied Computer Science and I happen to be working with NextJS for the first time which has been a great experience so far. And for some of your recent videos align almost perfectly with what I am working on in the internship. It has helped me out a lot and it's interesting to see a pov of another developer. Keep doing the greate videos

[rodjenihm]

Seems like rate limiting based on IP can be done before the request even reaches the application server, on reverse proxy or load balancer level. But if you need rate limiting based on business logic (let's say which package the user bought) then it needs to live in the app logic. Layer 4 vs Layer 7 rate limiting

[thirtykey]

Great video as always. I like the considerations and drawbacks you mention when explaining why you make certain decisions. One thing I noticed that could be fixed is that the rate limiting windowing does not slide. What I mean by that is if you configure it to allow two requests every ten seconds, your current logic would allow requests through at t = 0s, 9s, 12s, 14s. The last three requests occur within a span of five seconds, but your logic would reset the count to zero at t = 12s and allow all requests through. Seemingly simple mechanisms like this can often end up being somewhat complex.

[shorts_faceless]

Please make a video on:
1/ implementing background jobs in nextjs (e.g., your app can generate an entire movie script, but it takes 20 minutes, so you want to implement it as a background job -- the customer can leave the site and get an email notification when it's done)
2/ how to address situations where your app depends on external APIs that have very low concurrency limits

[SonAyoD]

Great video and thanks for answering my previous question here more in-depth.

[iken_ar]

Thank you, being waiting for this 🤝👏🏼👏🏼

[joaomendoncayt]

Hey cody, suggestion for a video using this one as a segway:

"let's automate testing for the rate limiting by using playwright" where you automate the part of spamming logins with the same account with an e2e test (can be any library/framework, playwright was an example)

this test would obviously give more contractual coverage than simply for rate limiting, but that would be the point aswell

Thank you for all the videos!

[Adityacode]

I just cant thank you enough. Excellent content ❤.

[kawa]

thanks for the video! comes at a perfect time cause I've been looking into rate limiting

[avijitchanda]

Thanks for the video man ❤ you have seen my comment and made this gem for me

[jowia]

Going to implement this tonight, love these videos

[virtual]

Looks convenient. One disadvantage of fixed bulk limiting though is it can sometimes interfere with workflow of normal (not malicious) users. If users exceed limit in half of window, then they would have to wait for remaining half of window even if they need only one more operation. Is there simple way to make adaptive rate limiter that handles it? Not sure how to word it better. A moving window perhaps? A queue?

[domson_]

I can suggest to use Map insead of Object. Map is optimized for setting and getting keys. Little hint from me😉

[omomer]

Reading you being unhinged on X then coming to see a very usefull video of yours almost immediately is so bizarre 😂😂😂😂😂😂

Thanks for the knowledge

[donrulr]

IP addresses can sometimes be considered personal under strict GDPR rules. Is there any reason to prefer rate limiting via IP over session-based?

[iken_ar]

seems pretty easy, really appreciate that,
we just may need to clear the trackers object, cause it may get a ddos as you said
thanks again, now at least we got an idea of how it works 🤝

[Ghareonn]

A couple of improvements. Consider using an actual Map they are much faster than plain objects when you need to insert and remove keys constantly. You should also consider removing old keys after they are expired for some time.

[ooccococococooco]

In all of my projects i make a "rate limit action" model and use that to rate limit, then a cronjob to clean them up after two days. Seems like a simpler approach to me

[griffadev]

Think I'd rather host a redis instance for this to avoid issues with multiple servers and memory issues on the server (less important as you mentioned)

Introducing redis early gives app nice caching tooling too