SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

Hi SuperTokens team, I am using Supertokens with NestJs. All my APIs are rate limited via https://docs.nestjs.com/security/rate-limiting. Do you have any clue to let the SuperTokens middleware (for calls like e.g. /auth/signin) be aware of these rate-limiting settings?

you essentially have to covert the rate limiting to a middleware and apply that middleware before the supertokens middleware runs

Hey <@498057949541826571>, did you do that already or ideally have some sample code?
It would be outstanding to inject the already available NestJS  rate-limiting mechanism for that.

maybe <@435107855880683521> can help out here

Sadly, I don't see any straightforward way to apply this to our middleware :/ One thing you could test is trying to apply this as globally as possible, by adding this provider to the module
```
{
  provide: APP_GUARD,
  useClass: ThrottlerGuard
}
```
(they write about this at the start of the guide you linked)

if that doesn't work, then it'd have to be a second middleware that is applied before our middleware

<@435107855880683521> can you show an example of how a new middleware can be created that does this please?

Sure, I'll get back with an example in 1-2h

I already added the ThrottlerGuard globally via `provide: APP_GUARD`.  Unfortunately, this doesn't help with the supertokens middleware 🙁 .

This is what I came up with:
```ts
import { Injectable, NestMiddleware } from '@nestjs/common';
import { middleware } from 'supertokens-node/framework/express';
import { RateLimiterMemory } from 'rate-limiter-flexible';

@Injectable()
export class AuthMiddleware implements NestMiddleware {
  supertokensMiddleware: any;
  rateLimiter: RateLimiterMemory;
  combinedMiddleware: any;

  constructor() {
    this.rateLimiter = new RateLimiterMemory({
      points: 2, // 2 requests
      duration: 60, // per 60 second by IP
    });
    this.supertokensMiddleware = middleware();

    this.combinedMiddleware = (req, res, next) => {
      this.rateLimiter
        .consume(req.ip)
        .then(() => {
          this.supertokensMiddleware(req, res, next);
        })
        .catch(() => {
          res.status(429).send('Too Many Requests');
        });
    };
  }

  use(req: Request, res: any, next: () => void) {
    return this.combinedMiddleware(req, res, next);
  }
}

```

There are a couple of ways around this, but this lib seems very flexible (it's in the name! 😄 ), popular and maintained.

One caveat: this will add rate-limiting to all your APIs, so you might want to limit where you are using the `AuthMiddleware`

Hey <@435107855880683521> this is super nice. Many thanks for the code excerpt!
I'll give it a try! 
Have a lovely Friday + weekend. Thanks! 🎉

Hey <@435107855880683521> I tried your approach - it's working 😀 ! Thanks a lot.
I avoid the caveat you mentioned by using a specific apiBasePath.
So, the supertokens middleware is only called for this specific apiBasePath.

also, that's a good solution the caveat. I mentioned it because in the guide the middleware is applied to "*" IIRC

Wait, how does Global Guard not work? 😲