1// Token Bucket Rate Limiter using Redis
2// Handles distributed rate limiting across multiple API gateway instances
3 
4const redis = new Redis(process.env.REDIS_URL);
5 
6async function checkRateLimit(
7  identifier: string,  // 'user:123' or 'ip:1.2.3.4'
8  maxTokens: number,
9  refillRate: number   // tokens per second
10): Promise<{ allowed: boolean; remaining: number }> {
11  const key = `ratelimit:${identifier}`;
12  const now = Date.now() / 1000;
Lua script executes atomically in Redis — no race conditions between check and decrement
13 
14  // Lua script: atomic check-and-update (prevents race conditions)
15  const luaScript = `
16    local key = KEYS[1]
17    local max_tokens = tonumber(ARGV[1])
18    local refill_rate = tonumber(ARGV[2])
19    local now = tonumber(ARGV[3])
20 
21    local data = redis.call('HMGET', key, 'tokens', 'last_refill')
22    local tokens = tonumber(data[1]) or max_tokens
23    local last_refill = tonumber(data[2]) or now
24 
25    -- Refill based on elapsed time
Token bucket: full bucket allows burst up to maxTokens; steady state limited to refillRate/sec
26    local elapsed = now - last_refill
27    tokens = math.min(max_tokens, tokens + elapsed * refill_rate)
28 
29    if tokens >= 1 then
30      tokens = tokens - 1
31      redis.call('HMSET', key, 'tokens', tokens, 'last_refill', now)
32      redis.call('EXPIRE', key, 86400)
33      return {1, math.floor(tokens)}  -- {allowed, remaining}
34    else
35      return {0, 0}  -- denied
36    end
37  `;
38 
39  const [allowed, remaining] = await redis.eval(
40    luaScript, 1, key,
41    maxTokens.toString(), refillRate.toString(), now.toString()
42  ) as [number, number];
43 
44  return { allowed: allowed === 1, remaining };
Always return rate limit headers — clients need these to implement backoff
45}
46 
47// Middleware
48export async function rateLimitMiddleware(req: Request, res: Response, next: NextFunction) {
429 Too Many Requests is the correct HTTP status code for rate limiting (RFC 6585)
49  const result = await checkRateLimit(`user:${req.user.id}`, 100, 10);
50 
51  res.setHeader('X-RateLimit-Remaining', result.remaining);
52 
53  if (!result.allowed) {
54    return res.status(429).json({ error: 'Rate limit exceeded' });
55  }
56  next();
57}