Rate Limiting in Next.js with Upstash Redis: Protect Your API in 10 Minutes

pnpm add @upstash/redis @upstash/ratelimit

// src/lib/redis.ts
import { Redis } from "@upstash/redis";
import { env } from "~/env";
 
export const redis = new Redis({
  url: env.UPSTASH_REDIS_REST_URL,
  token: env.UPSTASH_REDIS_REST_TOKEN,
});

// src/lib/rate-limit.ts
import { Ratelimit } from "@upstash/ratelimit";
import { redis } from "./redis";
 
export const loginLimiter = new Ratelimit({
  redis,
  limiter: Ratelimit.slidingWindow(5, "15 m"), // 5 attempts / 15 min
  analytics: true,
  prefix: "ratelimit:login",
});

// src/app/api/auth/[...nextauth]/route.ts
import { loginLimiter } from "~/lib/rate-limit";
 
export async function POST(req: Request) {
  const ip =
    req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "anonymous";
 
  const { success, limit, remaining, reset } = await loginLimiter.limit(ip);
 
  if (!success) {
    return new Response(
      JSON.stringify({
        error: "Too many attempts. Try again in a few minutes.",
      }),
      {
        status: 429,
        headers: {
          "X-RateLimit-Limit": String(limit),
          "X-RateLimit-Remaining": String(remaining),
          "X-RateLimit-Reset": String(reset),
          "Retry-After": String(Math.ceil((reset - Date.now()) / 1000)),
        },
      },
    );
  }
 
  // ... rest of the auth handler
}

// src/lib/rate-limit.ts
export const trpcLimiter = new Ratelimit({
  redis,
  limiter: Ratelimit.slidingWindow(100, "1 m"), // 100 req/min per user
  prefix: "ratelimit:trpc",
});

// src/server/api/trpc.ts
import { trpcLimiter } from "~/lib/rate-limit";
 
export const protectedProcedure = t.procedure.use(
  async ({ ctx, next, path }) => {
    if (!ctx.session?.user) {
      throw new TRPCError({ code: "UNAUTHORIZED" });
    }
 
    // Rate limit by user + endpoint
    const key = `${ctx.session.user.id}:${path}`;
    const { success, reset } = await trpcLimiter.limit(key);
 
    if (!success) {
      throw new TRPCError({
        code: "TOO_MANY_REQUESTS",
        message: `Try again in ${Math.ceil((reset - Date.now()) / 1000)}s`,
      });
    }
 
    return next({ ctx: { ...ctx, session: ctx.session } });
  },
);

export const aiLimiter = new Ratelimit({
  redis,
  // 30 AI calls / hour / organization
  limiter: Ratelimit.slidingWindow(30, "1 h"),
  prefix: "ratelimit:ai",
});
 
// Inside a tRPC procedure
generateContent: requirePermission("ai:use")
  .input(z.object({ prompt: z.string() }))
  .mutation(async ({ ctx, input }) => {
    const orgId = ctx.session.user.organizationId;
    const { success } = await aiLimiter.limit(orgId);
 
    if (!success) {
      throw new TRPCError({
        code: "TOO_MANY_REQUESTS",
        message: "Hourly AI limit reached for your organization",
      });
    }
 
    return generateWithMistral(input.prompt);
  }),

export const webhookLimiter = new Ratelimit({
  redis,
  limiter: Ratelimit.tokenBucket(50, "10 s", 100), // burst 100, refill 50/10s
  prefix: "ratelimit:webhook",
});
 
export async function POST(req: Request) {
  const ip = req.headers.get("x-forwarded-for") ?? "unknown";
  const { success } = await webhookLimiter.limit(`stripe:${ip}`);
  if (!success) return new Response("Rate limited", { status: 429 });
 
  // ... HMAC signature verification + processing
}

const WHITELIST_IPS = new Set(env.RATE_LIMIT_WHITELIST?.split(",") ?? []);
 
export async function checkRateLimit(
  limiter: Ratelimit,
  identifier: string,
  ip: string,
) {
  if (WHITELIST_IPS.has(ip)) return { success: true };
 
  return limiter.limit(identifier);
}

# .env.local: for dev
RATE_LIMIT_WHITELIST="127.0.0.1,::1"
 
# Vercel Production
RATE_LIMIT_WHITELIST="" # empty in prod

import { track } from "@vercel/analytics/server";
 
if (!success) {
  await track("rate_limit_hit", {
    limiter: "trpc",
    userId: ctx.session.user.id,
  });
  throw new TRPCError({ code: "TOO_MANY_REQUESTS" });
}