Implementing Role-Based Rate Limiting

Welcome to the fourth lesson of the "Implementing Rate Limiting" course! In this lesson, we will explore the concept of role-based rate limiting, a crucial aspect of API security. Role-based access control (RBAC) allows us to assign different permissions and access levels to users based on their roles, such as anonymous, standard, premium, and admin users. This lesson will guide you through implementing and testing role-based rate limiting using the express-rate-limit library in a TypeScript-based REST API. By the end of this lesson, you'll be equipped to tailor API access based on user roles, ensuring both security and optimal resource usage. Let's dive in! 🚀

Role-based rate limiting is a method of controlling the number of requests a user can make to an API based on their assigned role. Unlike global or endpoint-specific rate limiting, which applies the same limits to all users or specific endpoints, role-based rate limiting allows for more granular control. This approach is essential for ensuring that different user roles have access to the resources they need without compromising the security or performance of the API.

For instance, an admin user might require a higher request limit than a standard user due to their need to perform more administrative tasks. By using the express-rate-limit library, we can implement these tailored limits in a TypeScript REST API, enhancing both security and user experience.

Before we implement role-based rate limiting, it's important to understand how we'll identify user roles. We'll use JSON Web Tokens (JWT) for this purpose. JWT is an open standard that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.

In our context, when a user logs in, they receive a JWT that contains:

• Their user ID
• Their role (admin, premium, standard, etc.)
• An expiration time

This token is signed with a secret key known only to the server, making it secure and tamper-proof. When the user makes requests to the API, they include this token in the Authorization header, allowing the server to:

1. Verify the token's authenticity
2. Extract information about the user (including their role)
3. Apply the appropriate rate limits based on that role

Now, let's implement role-based rate limiting using the express-rate-limit library. We'll start by setting up the rate limiter to assign different request limits based on user roles.

import rateLimit from 'express-rate-limit';
import jwt from 'jsonwebtoken';
import { Request } from 'express';
import { JWT_SECRET_KEY } from '../../config';

// Define the interface for our JWT payload
interface JWTPayload {
  userId: string;
  role: 'admin' | 'premium' | 'standard';
  iat: number;
  exp: number;
}

export const roleBasedLimiter = rateLimit({
  windowMs: 30 * 1000, // 30 seconds
  max: (req: Request) => {
    const authHeader = req.headers.authorization;
    if (authHeader) {
      try {
        const token = authHeader.split(' ')[1];
        const decoded = jwt.verify(token, JWT_SECRET_KEY) as JWTPayload;
        if (decoded) {
          switch (decoded.role) {
            case 'admin': return 100;
            case 'premium': return 30;
            default: return 10;
          }
        }
      } catch (error) {
        // Token verification failed
      }
    }
    return 5; // Unauthenticated users
  }
});

In this code, we configure the rate limiter to apply different request limits based on the user's role. We first define a JWTPayload interface that specifies the structure of our JWT token's payload. The max function then extracts the user's role from the JWT token and assigns the appropriate limit: 100 requests for admin, 30 for premium, 10 for standard, and 5 for unauthenticated users.

Next, we apply the configured rate limiter to the /premium-content endpoint.

import express from 'express';
import { roleBasedLimiter } from '../middleware/rate-limiters';

const router = express.Router();

router.get('/premium-content', roleBasedLimiter, (req, res) => {
  res.json({ message: 'This is premium content with role-based rate limiting' });
});

Here, we attach the roleBasedLimiter middleware to the /premium-content route. This ensures that requests to this endpoint are subject to the role-based rate limits we defined earlier.

With the role-based rate limiting in place, it's time to test its effectiveness. We'll simulate requests from different user roles and analyze the outcomes.

import axios from 'axios';
import jwt from 'jsonwebtoken';
import { JWT_SECRET_KEY } from '../src/config';

function createToken(userId, role) {
  return jwt.sign({ userId, role }, JWT_SECRET_KEY, { expiresIn: '1h' });
}

(async () => {
  const standardToken = createToken('user123', 'standard');
  const premiumToken = createToken('user456', 'premium');
  const adminToken = createToken('admin789', 'admin');

  const roles = [
    { name: 'anonymous', token: null, requests: 7 },
    { name: 'standard', token: standardToken, requests: 12 },
    { name: 'premium', token: premiumToken, requests: 32 },
    { name: 'admin', token: adminToken, requests: 20 }
  ];

  for (const role of roles) {
    for (let i = 1; i <= role.requests; i++) {
      try {
        const config = role.token ? {
          headers: { Authorization: `Bearer ${role.token}` }
        } : {};
        
        const resp = await axios.get('http://localhost:3001/api/snippets/premium-content', config);
        console.log(`Request ${i}:`, resp.status, "Success");
      } catch (err) {
        if (err.response) {
          console.log(`Request ${i}:`, err.response.status, err.response.data);
        } else {
          console.log(`Request ${i}: Failed -`, err.message);
        }
      }
      await new Promise(resolve => setTimeout(resolve, 50));
    }
  }
})();

In this test script, we create JWT tokens for different roles and simulate requests to the /premium-content endpoint. By analyzing the response logs, we can verify that the rate limits are enforced correctly, with each role receiving the appropriate number of requests before hitting the limit.

In this lesson, we explored the concept of role-based rate limiting and its implementation in a TypeScript REST API. We demonstrated how to assign different request limits based on user roles and tested the effectiveness of this approach. By tailoring access according to user roles, we can enhance both security and user experience.

As you move on to the practice exercises, you'll have the opportunity to apply what you've learned and further solidify your understanding. In the upcoming lessons, we'll continue to build on these concepts, exploring additional security measures to protect your API. Keep up the great work, and let's continue to secure our APIs! 🎉