How to make API rate limit policy in loopback

Question

I just want to make an API requests rate limiting per account plan so let's say that we have users and every user have a plan that has some limits of how many API requests per day they can make.

So now, How can i make an API limit policy in loopback 3.x.

Thanks

Answer 1

If you're planning on using Loopback on IBM Bluemix hosting you can use their API Connect service that includes customer plan based policies with API level throttling, monitoring, API billing and many other API management features.

StrongLoop API Microgateway is used by API Connect but is now open sourced (Apr 2017).

Since Loopback is just a layer on top of Express, you can alternatively just use an Express lib.

For rate limiting on a single standalone Loopback server you can use one of these Express libs:

• express-rate-limit
• express-throttle

If you plan to use this on a cluster of Loopback servers you'll need to store the API call counts as part of the shared server state of each user or user session. The weapon of choice for this is Redis since it's a high performance in memory data store that can be scaled. Rate limiting Express libs that support Redis include:

• strict-rate-limiter
• express-brute
• express-limiter

Finally, you could also implement rate limiting on a reverse proxy. See Nginx Rate Limiting

Answer 2

This is an access control policy.

You can handle this by custom roles created by role resolver.

By creating a custom role and checking in that resolver callback if the current user exceeded from rate limit or not.