Hi SuperTokens team, I am using Supertokens with NestJs. All my APIs are rate limited via https://docs.nestjs.com/security/rate-limiting. Do you have any clue to let the SuperTokens middleware (for calls like e.g. /auth/signin) be aware of these rate-limiting settings?

hey @DanielAtStruggly

Hey @rp_st, did you do that already or ideally have some sample code? It would be outstanding to inject the already available NestJS rate-limiting mechanism for that.

maybe @porcellus can help out here

hi

Thanks guys!

Sadly, I don't see any straightforward way to apply this to our middleware :/ One thing you could test is trying to apply this as globally as possible, by adding this provider to the module

{
  provide: APP_GUARD,
  useClass: ThrottlerGuard
}

(they write about this at the start of the guide you linked)

@porcellus can you show an example of how a new middleware can be created that does this please?

Sure, I'll get back with an example in 1-2h

I already added the ThrottlerGuard globally via

provide: APP_GUARD

. Unfortunately, this doesn't help with the supertokens middleware 🙁 .

This is what I came up with:

ts
import { Injectable, NestMiddleware } from '@nestjs/common';
import { middleware } from 'supertokens-node/framework/express';
import { RateLimiterMemory } from 'rate-limiter-flexible';

@Injectable()
export class AuthMiddleware implements NestMiddleware {
  supertokensMiddleware: any;
  rateLimiter: RateLimiterMemory;
  combinedMiddleware: any;

  constructor() {
    this.rateLimiter = new RateLimiterMemory({
      points: 2, // 2 requests
      duration: 60, // per 60 second by IP
    });
    this.supertokensMiddleware = middleware();

    this.combinedMiddleware = (req, res, next) => {
      this.rateLimiter
        .consume(req.ip)
        .then(() => {
          this.supertokensMiddleware(req, res, next);
        })
        .catch(() => {
          res.status(429).send('Too Many Requests');
        });
    };
  }

  use(req: Request, res: any, next: () => void) {
    return this.combinedMiddleware(req, res, next);
  }
}

Hey @porcellus this is super nice. Many thanks for the code excerpt! I'll give it a try! Have a lovely Friday + weekend. Thanks! 🎉

thanks @porcellus !

happy to help 🙂

Hey @porcellus I tried your approach - it's working 😀 ! Thanks a lot. I avoid the caveat you mentioned by using a specific apiBasePath. So, the supertokens middleware is only called for this specific apiBasePath.

that's good to hear 🙂

Wait, how does Global Guard not work? 😲