High-Concurrency Distributed Rate Limiter for Node.js & NestJS with Redis

Standard fixed-window rate limiters suffer from boundary burst attacks: a malicious user can send their full quota at 00:59 and another full quota at 01:01, doubling the allowed rate and overwhelming backend services.

distributed-rate-limiter-node implements an atomic sliding-window log algorithm using optimized Redis Lua scripts, providing microsecond-level accuracy across distributed Node.js and NestJS clusters.

seotarek / distributed-rate-limiter-node

A high-concurrency sliding-window distributed rate limiter middleware for Express and NestJS backends powered by Redis.

Distributed Rate Limiter for Node.js 🛑⚡

A high-concurrency sliding-window distributed rate limiter middleware for Express and NestJS backends powered by Redis.

Developed by Tarek Mohamed (@seotarek)

View on GitHub

---

🚀 Key Advantages

• Atomic Lua Scripting: Single roundtrip execution prevents race conditions across multiple server instances.
• Express & NestJS Decorators: Clean, plug-and-play middleware and guard integration.
• Dynamic Tiering: Easily apply different limits for authenticated users, IP addresses, or API keys.

---

💻 NestJS Example

import { Controller, Get, UseGuards } from '@nestjs/common';
import { RateLimitGuard, RateLimit } from 'distributed-rate-limiter-node';

@Controller('api')
@UseGuards(RateLimitGuard)
export class ApiController {
  @Get('search')
  @RateLimit({ points: 20, duration: 60 }) // 20 requests per minute
  search() {
    return { status: 'success' };
  }
}

Star and install on GitHub:
👉 https://github.com/seotarek/distributed-rate-limiter-node