All 5 Route Handlers (API Route.js) questions
More in Route Handlers (API Route.js)
What is a route handler in the Next.js App Router, and how do you create one? How do you read query parameters and the request body inside a route handler? How do you access dynamic route parameters inside a route handler defined with a dynamic segment? How do you set custom response headers, such as CORS headers, in a route handler to allow requests from a different domain?
Advertisement
Back to results for “Security”
Next.js › Route Handlers (API Route.js)

How would you implement rate limiting inside a route handler to prevent abuse of a public API endpoint?

Advanced

Answer

You track the number of requests coming from a specific identifier, such as an IP address or an API key, over a time window, usually using an external store like Redis for reliability across multiple server instances, and return a too many requests response once a client exceeds the allowed limit within that window.
export async function GET(request) {
  const ip = request.headers.get('x-forwarded-for');
  const requestCount = await getRequestCount(ip);
  if (requestCount > 100) {
    return Response.json({ error: 'Too many requests' }, { status: 429 });
  }
  await incrementRequestCount(ip);
  return Response.json({ data: 'success' });
}
Real-world example A public weather API endpoint limits each visitor to one hundred requests per hour, protecting the service from being overwhelmed by a single client sending excessive traffic.

Common follow-ups: What storage options work best for tracking rate limits across multiple server instances?;How do you communicate the remaining rate limit to API consumers?

Security Best Practices in Next.js;Edge Runtime vs Node.js Runtime
All 5 Route Handlers (API Route.js) questions