UpdatedAug 5, 2026

Koa Rate Limiting

Question Variations

"Why does an in-memory Koa limiter fail when scaled?"
"When should a limiter key use a user instead of an IP?"
"What should an API return after a rate limit is exceeded?"

Why This Is Asked

Rate limiting is a distributed systems concern exposed at the HTTP boundary. Interviewers assess whether you design a fair policy that still works across Koa replicas and reverse proxies.

Key Concepts

A limiter needs a key, policy, response, and storage model.
Identity-based keys are often more meaningful than IPs after authentication.
Multiple replicas require shared atomic state or gateway enforcement.
Login and recovery routes should be protected especially carefully.

Question Variations

“Why does an in-memory Koa limiter fail when scaled?”
“When should a limiter key use a user instead of an IP?”
“What should an API return after a rate limit is exceeded?”

Answers by Technology

+ Add Variant

Koa.jsImprove this answer ✏️

Expected Answer (Koa 3.2.1 / Node.js 18+)

Rate limiting needs a defined key, policy, and distributed storage model. Limit by an API key, authenticated user, or tenant when available; use IP carefully because NAT and proxy trust affect it. In a multi-instance Koa deployment, use a shared atomic store or enforce limits at the gateway. Return 429 and a retry indication without revealing sensitive account state.

Why It Matters

Correct limits protect availability without unfairly blocking legitimate customers.

Code Example

import Koa, { Context, Next } from 'koa';

const app = new Koa(); const seen = new Map<string, number>();
app.use(async (ctx: Context, next: Next) => {
  const count = (seen.get(ctx.ip) ?? 0) + 1; seen.set(ctx.ip, count);
  if (count > 5) { ctx.status = 429; ctx.set('Retry-After', '60'); return; }
  await next();
});
app.use((ctx: Context) => { ctx.body = { ok: true }; }); app.listen(3000);

Common Mistakes

Using process-local counters across replicas: Each instance grants a separate quota.
Using client IP without proxy controls: The identity can be wrong or spoofed.

Follow-up Questions

What policy permits controlled bursts? (Answer: Token bucket.)
Why also limit users? (Answer: A user can distribute abuse across many IPs.)