Skip to content

Commit 9fa9351

Browse files
Merge pull request #2263 from Tony133/docs/update-rate-limiting-customization
docs(rate-limiting): improvements in the customization section
2 parents 7d3515a + 853f8ca commit 9fa9351

File tree

1 file changed

+35
-2
lines changed

1 file changed

+35
-2
lines changed

content/security/rate-limiting.md

Lines changed: 35 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,46 @@ Once the module has been imported, you can then choose how you would like to bin
3535

3636
There may be a time where you want to bind the guard to a controller or globally, but want to disable rate limiting for one or more of your endpoints. For that, you can use the `@SkipThrottle()` decorator, to negate the throttler for an entire class or a single route. The `@SkipThrottle()` decorator can also take in a boolean for if there is a case where you want to exclude _most_ of a controller, but not every route.
3737

38-
There is also the `@Throttle()` decorator which can be used to override the `limit` and `ttl` set in the global module, to give tighter or looser security options. This decorator can be used on a class or a function as well. The order for this decorator does matter, as the arguments are in the order of `limit, ttl`.
38+
```typescript
39+
@SkipThrottle()
40+
@Controller('users')
41+
export class UsersController {}
42+
```
43+
44+
This `@SkipThrottle()` decorator can be used to skip a route or a class or to negate the skipping of a route in a class that is skipped.
45+
46+
```typescript
47+
@SkipThrottle()
48+
@Controller('users')
49+
export class UsersController {
50+
// Rate limiting is applied to this route.
51+
@SkipThrottle(false)
52+
dontSkip() {
53+
return "List users work with Rate limiting.";
54+
}
55+
// This route will skip rate limiting.
56+
doSkip() {
57+
return "List users work without Rate limiting.";
58+
}
59+
}
60+
```
61+
62+
There is also the `@Throttle()` decorator which can be used to override the `limit` and `ttl` set in the global module, to give tighter or looser security options. This decorator can be used on a class or a function as well. The order for this decorator does matter, as the arguments are in the order of `limit, ttl`. You have to configure it like this:
63+
64+
```typescript
65+
// Override default configuration for Rate limiting and duration.
66+
@Throttle(3, 60)
67+
@Get()
68+
findAll() {
69+
return "List users works with custom rate limiting.";
70+
}
71+
```
3972

4073
#### Proxies
4174

4275
If your application runs behind a proxy server, check the specific HTTP adapter options ([express](http://expressjs.com/en/guide/behind-proxies.html) and [fastify](https://www.fastify.io/docs/latest/Reference/Server/#trustproxy)) for the `trust proxy` option and enable it. Doing so will allow you to get the original IP address from the `X-Forwarded-For` header, and you can override the `getTracker()` method to pull the value from the header rather than from `req.ip`. The following example works with both express and fastify:
4376

44-
```ts
77+
```typescript
4578
// throttler-behind-proxy.guard.ts
4679
import { ThrottlerGuard } from '@nestjs/throttler';
4780
import { Injectable } from '@nestjs/common';

0 commit comments

Comments
 (0)