Rate limiting and audit logs

Rate limiting curbs abuse, credential stuffing, and expensive endpoints. Key by user ID, API key, IP (with proxy awareness), or tenant. Use token bucket or sliding window; return 429 with `Retry-After`.

					import { RateLimiterRedis } from 'rate-limiter-flexible';

const limiter = new RateLimiterRedis({
  storeClient: redis,
  keyPrefix: 'rl_login',
  points: 5,
  duration: 60,
});

try {
  await limiter.consume(req.ip);
} catch {
  return res.status(429).json({ error: 'too_many_requests' });
}
				

Audit logs record security-sensitive events: login success/failure, permission changes, data exports, admin actions. Append-only storage, synchronized clocks, actor + target + outcome, no secrets in payloads.

On interviews: distributed rate limiting with Redis; per-route vs global limits; audit log retention and GDPR tension.

Common pitfalls: rate limiting only by IP behind carrier NAT; logging passwords on failed login; mutable audit tables without integrity controls.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Identity-aware limits on auth and costly routes.
• Structured audit events with correlation IDs.
• Tamper-evident or WORM storage for compliance.
• Alert on anomaly patterns (burst failures, mass export).