Rate Limiting & Brute-Force Defence

Redis-backed sliding window rate limiter in TypeScript

import Redis from 'ioredis';
import { Request, Response, NextFunction } from 'express';

const redis = new Redis(process.env.REDIS_URL!);

async function slidingWindowLimit(
  key: string,
  maxRequests: number,
  windowSec: number
): Promise<{ allowed: boolean; remaining: number; resetAt: number }> {
  const now = Date.now();
  const windowStart = now - windowSec * 1000;

  const pipeline = redis.pipeline();
  pipeline.zremrangebyscore(key, 0, windowStart);       // remove old entries
  pipeline.zadd(key, now, now.toString());               // add current request
  pipeline.zcard(key);                                   // count in window
  pipeline.expire(key, windowSec);                       // auto-cleanup
  const results = await pipeline.exec();
  const count = (results?.[2]?.[1] as number) ?? 0;

  return {
    allowed: count <= maxRequests,
    remaining: Math.max(0, maxRequests - count),
    resetAt: now + windowSec * 1000,
  };
}

export function rateLimitMiddleware(maxRequests: number, windowSec: number) {
  return async (req: Request, res: Response, next: NextFunction) => {
    const key = 'rl:' + (req.ip ?? 'unknown') + ':' + req.path;
    const result = await slidingWindowLimit(key, maxRequests, windowSec);
    res.setHeader('X-RateLimit-Limit', maxRequests);
    res.setHeader('X-RateLimit-Remaining', result.remaining);
    res.setHeader('X-RateLimit-Reset', Math.ceil(result.resetAt / 1000));
    if (!result.allowed) {
      res.status(429).json({ error: 'Rate limit exceeded. Try again later.' });
      return;
    }
    next();
  };
}

Sorted set (ZSET) with score=timestamp stores each request; ZREMRANGEBYSCORE prunes entries outside the window before counting. All operations run in a single pipeline, reducing round trips. The sliding window is more accurate than fixed windows, which allow burst traffic at window boundaries.

Rate limiting in Rails with rack-attack

# config/initializers/rack_attack.rb
class Rack::Attack
  # Use Redis for distributed counting
  Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(
    url: ENV.fetch('REDIS_URL')
  )

  # Throttle login attempts per IP: 5 per 20 seconds
  throttle('login/ip', limit: 5, period: 20.seconds) do |req|
    req.ip if req.path == '/api/v1/auth/login' && req.post?
  end

  # Throttle login attempts per email: 10 per hour (prevent credential stuffing)
  throttle('login/email', limit: 10, period: 1.hour) do |req|
    if req.path == '/api/v1/auth/login' && req.post?
      req.params['email'].to_s.downcase.strip.presence
    end
  end

  # Allow health checks to bypass throttling
  safelist('health-check') do |req|
    req.path == '/health'
  end

  # Custom response for throttled requests
  self.throttled_responder = lambda do |_env|
    [429, { 'Content-Type' => 'application/json' }, ['{"error":"Rate limit exceeded"}']]
  end
end

rack-attack (v6.7+) operates at the Rack middleware layer, before Rails routing, ensuring rate limits apply even to malformed requests. Per-email throttling prevents credential stuffing even when attackers distribute attempts across many IPs.