How do you implement API rate limiting with sliding window algorithm?

Question

Accepted Answer

**Sliding window** — tracks requests within a moving time window.

```javascript
const Redis = require("ioredis");
const redis = new Redis();

async function slidingWindowRateLimit(key, limit, windowMs) {
    const now = Date.now();
    const windowStart = now - windowMs;

const pipeline = redis.pipeline();
    pipeline.zremrangebyscore(key, 0, windowStart);
    pipeline.zadd(key, now, `${now}-${Math.random()}`);
    pipeline.zcard(key);
    pipeline.pexpire(key, windowMs);

const results = await pipeline.exec();
    const count = results[2][1];

return {
        allowed: count <= limit,
        remaining: Math.max(0, limit - count),
        resetAt: now + windowMs,
    };
}

// Middleware
async function rateLimitMiddleware(req, res, next) {
    const key = `rate:${req.ip}`;
    const result = await slidingWindowRateLimit(key, 100, 60000);

res.setHeader("X-RateLimit-Limit", 100);
    res.setHeader("X-RateLimit-Remaining", result.remaining);
    res.setHeader("X-RateLimit-Reset", result.resetAt);

if (!result.allowed) {
        return res.status(429).json({ error: "Too many requests" });
    }
    next();
}
```

**Advantages over fixed window:**
- No burst at window boundaries.
- More accurate counting.

Node.js: How do you implement API rate limiting with sliding window algorithm?