Rate Limiting

1// src/lib/rate-limit.ts
2
3import { Ratelimit } from "@upstash/ratelimit";
4import { Redis } from "@upstash/redis";
5
6// Create a rate limiter with 10 requests per 10 seconds
7export const ratelimit = new Ratelimit({
8  redis: Redis.fromEnv(),
9  limiter: Ratelimit.slidingWindow(10, "10 s"),
10  analytics: true,
11  prefix: "@upstash/ratelimit",
12});
13
14// Alternative: In-memory rate limiting for development
15import { LRUCache } from "lru-cache";
16
17const tokenCache = new LRUCache<string, number>({
18  max: 500,
19  ttl: 60_000, // 1 minute
20});
21
22export function rateLimit(ip: string, limit: number = 10) {
23  const tokenCount = tokenCache.get(ip) || 0;
24
25  if (tokenCount >= limit) {
26    return { success: false, remaining: 0 };
27  }
28
29  tokenCache.set(ip, tokenCount + 1);
30  return { success: true, remaining: limit - tokenCount - 1 };
31}

1// src/app/api/your-route/route.ts
2
3import { NextRequest, NextResponse } from "next/server";
4import { ratelimit } from "@/lib/rate-limit";
5
6export async function POST(request: NextRequest) {
7  // Get client IP
8  const ip = request.ip ??
9    request.headers.get("x-forwarded-for") ??
10    "127.0.0.1";
11
12  // Check rate limit
13  const { success, limit, reset, remaining } = await ratelimit.limit(ip);
14
15  if (!success) {
16    return NextResponse.json(
17      { error: "Too many requests. Please try again later." },
18      {
19        status: 429,
20        headers: {
21          "X-RateLimit-Limit": limit.toString(),
22          "X-RateLimit-Remaining": remaining.toString(),
23          "X-RateLimit-Reset": reset.toString(),
24          "Retry-After": Math.ceil((reset - Date.now()) / 1000).toString(),
25        },
26      }
27    );
28  }
29
30  // Process request normally
31  return NextResponse.json({ success: true });
32}

1// src/lib/rate-limit.ts
2
3import { Ratelimit } from "@upstash/ratelimit";
4import { Redis } from "@upstash/redis";
5
6const redis = Redis.fromEnv();
7
8// Strict limit for auth endpoints
9export const authLimiter = new Ratelimit({
10  redis,
11  limiter: Ratelimit.slidingWindow(5, "60 s"), // 5 per minute
12  prefix: "ratelimit:auth",
13});
14
15// Standard API limit
16export const apiLimiter = new Ratelimit({
17  redis,
18  limiter: Ratelimit.slidingWindow(60, "60 s"), // 60 per minute
19  prefix: "ratelimit:api",
20});
21
22// Generous limit for read operations
23export const readLimiter = new Ratelimit({
24  redis,
25  limiter: Ratelimit.slidingWindow(100, "60 s"), // 100 per minute
26  prefix: "ratelimit:read",
27});
28
29// Strict limit for write operations
30export const writeLimiter = new Ratelimit({
31  redis,
32  limiter: Ratelimit.slidingWindow(20, "60 s"), // 20 per minute
33  prefix: "ratelimit:write",
34});

1// src/app/api/protected-route/route.ts
2
3import { NextRequest, NextResponse } from "next/server";
4import { auth } from "@/lib/auth";
5import { ratelimit } from "@/lib/rate-limit";
6
7export async function POST(request: NextRequest) {
8  const session = await auth();
9
10  if (!session?.user?.id) {
11    return NextResponse.json(
12      { error: "Unauthorized" },
13      { status: 401 }
14    );
15  }
16
17  // Rate limit by user ID (more fair than IP)
18  const { success, remaining } = await ratelimit.limit(
19    `user:${session.user.id}`
20  );
21
22  if (!success) {
23    return NextResponse.json(
24      { error: "Rate limit exceeded" },
25      { status: 429 }
26    );
27  }
28
29  // Process request
30  return NextResponse.json({
31    success: true,
32    remaining
33  });
34}