Rate Limiting & Security Headers

🔗 REST API Lesson 12 Advanced

A public REST API without rate limiting is an open invitation for abuse, DoS attacks, and runaway costs. Security headers protect against common web vulnerabilities like XSS, clickjacking, and data leaking.

1 Rate Limiting with express-rate-limit

JavaScript — Rate Limiting Setup

const rateLimit = require("express-rate-limit");

// General API limiter
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,                 // max 100 requests per window per IP
  standardHeaders: true,    // Return RateLimit-* headers
  legacyHeaders: false,
  message: {
    success: false,
    error: { code: "RATE_LIMITED", message: "Too many requests. Try again later." }
  }
});

// Stricter limiter for auth endpoints (prevent brute force)
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 10,
  skipSuccessfulRequests: true, // only count failed attempts
  message: {
    success: false,
    error: { code: "RATE_LIMITED", message: "Too many login attempts. Try again in 15 minutes." }
  }
});

app.use("/api/", apiLimiter);
app.use("/api/v1/auth/login",    authLimiter);
app.use("/api/v1/auth/register", authLimiter);

2 Security Headers with Helmet

JavaScript — Helmet Security Headers

const helmet = require("helmet");
const cors   = require("cors");

app.use(helmet()); // Sets 15+ security headers automatically

// What helmet sets:
// Strict-Transport-Security: max-age=15552000; includeSubDomains
// X-Content-Type-Options: nosniff
// X-Frame-Options: SAMEORIGIN
// X-XSS-Protection: 0
// Content-Security-Policy: default-src 'self'...

// CORS — control who can access your API
app.use(cors({
  origin: ["https://myapp.com", "https://admin.myapp.com"],
  methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"],
  allowedHeaders: ["Content-Type", "Authorization", "X-API-Key"],
  credentials: true, // allow cookies
  maxAge: 86400      // preflight cache for 24h
}));

3 Code Challenge

Challenge: Implement a Redis-backed rate limiter using express-rate-limit with the rate-limit-redis store. This ensures rate limits persist across multiple server instances in a load-balanced environment.