Rate-limited API proxy at the edge

npm create cloudflare@latest rate-limit-proxy -- --type hello-world
cd rate-limit-proxy

export class RateLimiter {
  constructor(state, env) {
    this.state = state;
    this.env = env;
    this.requests = [];
  }

  async fetch(request) {
    const now = Date.now();
    const windowMs = 60 * 1000; // 1 minute sliding window
    const maxRequests = 60;      // 60 requests allowed per window

    // Evict timestamps outside the rolling window
    this.requests = this.requests.filter(t => now - t < windowMs);

    const remaining = Math.max(0, maxRequests - this.requests.length);

    if (this.requests.length >= maxRequests) {
      const oldest = this.requests[0];
      const retryAfterSeconds = Math.ceil((oldest + windowMs - now) / 1000);

      return new Response(JSON.stringify({
        error: 'Too Many Requests',
        message: 'Rate limit exceeded. Please try again later.',
        retryAfterSeconds
      }), {
        status: 429,
        headers: {
          'content-type': 'application/json',
          'X-RateLimit-Limit': String(maxRequests),
          'X-RateLimit-Remaining': '0',
          'Retry-After': String(retryAfterSeconds)
        }
      });
    }

    // Record current request
    this.requests.push(now);

    return new Response(JSON.stringify({ allowed: true, remaining: remaining - 1 }), {
      status: 200,
      headers: {
        'content-type': 'application/json',
        'X-RateLimit-Limit': String(maxRequests),
        'X-RateLimit-Remaining': String(remaining - 1)
      }
    });
  }
}

import { RateLimiter } from './limiter.js';

export { RateLimiter };

export default {
  async fetch(request, env, ctx) {
    const url = new URL(request.url);

    // Identify client by API Key or fallback to IP address
    const clientKey = request.headers.get('x-api-key') ||
                      request.headers.get('CF-Connecting-IP') ||
                      '127.0.0.1';

    // Get the Durable Object stub for this specific client
    const doId = env.RATE_LIMITER.idFromName(clientKey);
    const stub = env.RATE_LIMITER.get(doId);

    // Check rate limit
    const rateCheck = await stub.fetch(request.url);
    if (rateCheck.status === 429) {
      return rateCheck;
    }

    // Forward allowed request to origin
    const originUrl = new URL(request.url);
    originUrl.hostname = 'httpbin.org'; // Replace with your real origin host
    originUrl.protocol = 'https:';

    const proxyRequest = new Request(originUrl.toString(), request);
    const originResponse = await fetch(proxyRequest);

    // Clone response to attach rate limit header info
    const response = new Response(originResponse.body, originResponse);
    response.headers.set('X-RateLimit-Limit', '60');
    response.headers.set('X-RateLimit-Remaining', rateCheck.headers.get('X-RateLimit-Remaining') || '0');

    return response;
  }
};

name = "rate-limit-proxy"
main = "src/index.js"
compatibility_date = "2024-09-23"

[durable_objects]
bindings = [
  { name = "RATE_LIMITER", class_name = "RateLimiter" }
]

[[migrations]]
tag = "v1"
new_classes = ["RateLimiter"]

# Deploy the Worker to Cloudflare's edge
npx wrangler deploy

# Test with a quick 65-request burst
for i in {1..65}; do
  echo -n "Request #$i: "
  curl -s -o /dev/null -w "HTTP %{http_code}\n" https://rate-limit-proxy.YOUR_SUBDOMAIN.workers.dev/get
done