do you want to have a rate limit on a particular API or multiple APIs?

any would work i just want to add rate limit and how what i need and have to do

if you got example for both would be great

you need to implement it in middleware instead of apis. middleware is a sort of reverse proxy, which intercepts requests from users. here is my poc project that uses Redis cache.
https://github.com/tfutada/zenn-nextjs/blob/main/middleware-2.ts

if you host a Next.js on VPS with a single instance, you can use a global variable.

wouldn't radis get expensive if someone DDOS attack ?

yes. expensive.

can i use this example for single route or it's middleware so all routes

i was hoping for something like express rate limiter lol

import { rateLimit } from 'express-rate-limit'

const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
    standardHeaders: 'draft-7', // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
    legacyHeaders: false, // Disable the `X-RateLimit-*` headers
    // store: ... , // Use an external store for more precise rate limiting
})

// Apply the rate limiting middleware to all requests
app.use(limiter)

it's like as easy as this

where do you host?

i will host on vercel

okay. first off, you need to understand the diff btw Serverless and self-hosted on VPS.

yes please

your example from Express is supposed to run on a self-hosted VPS environment.

so things are so simple. you can use a global variable to manage request counter, limiter.

aha i see

so my only option for now would be redis

however, Vercel, which is serverless environment, which uses AWS lambda and Cloudflare Worker under the hood, multiple instances up and down in short time period.

so you can not use a global variable in serverless environment, so you need Redis cache.

i see can this work on single route?

if that's the case i think adding rate limit to only otp routes would be best approach

Vercel is a bit tricy as it gets involved in Cloudflare Worker.

but why you concern about rate limit? DDoS?

OTP codes

i want the OTP codes to be active for like an hour so i want user to send 1 request every hour or so

here's a guide: https://upstash.com/blog/nextjs-ratelimiting
you'll be locked into using redis and more specifically upstash's serverless redis, but it'll give you an idea on how to implement ratelimiting.

actually not sure if this is app dir though

that is page dir

yeah, mb didn't notice until after I posted

but thank you for the comment i will be using redis

this is with the app dir

looks like that uses upstash too

how abt using a cookie?

how can we implement that?

that sound like good idea

what's the usecase for the cache?

i want the OTP codes to be active for like an hour so i want user to send 1 request every hour or so

so timestamp or something

ahhhh that's also great idea!

and check the time and deny request

i didn't think about that, it's actually smart

&1089670008898080870 after applying the matcher like '/dashboard/:path*' after refreshing the url changes to /dashboard/[path]