How to rate limit a node.js API that uses JWT?

Question

I have a node.js application that runs on different servers/containers. Clients are authenticated with JWT tokens. I want to protect this API from DDos attacks. User usage limit settings can be stored in the token. I've been thinking about som approaches:

• Increment counters in a memory database like redis or memcached and check it on every request. Could cause bottlenecks?.
• Do something in a nginx server (is it possible?)
• Use some cloud based solution (AWS WAF? Cloudfront? API Gateway? Do they do what I want?)

How to solve this?

Answer 1

There are dedicated npm packages like

• express-rate-limit https://www.npmjs.com/package/express-rate-limit

• ratelimiter https://www.npmjs.com/package/ratelimiter

I don't know about AWS but in Azure you can use Azure API Management to secure your api https://learn.microsoft.com/en-us/azure/api-management/api-management-key-concepts