Rate limiting enforced per authenticated user

Without per-user rate limiting, a single authenticated account can exhaust compute, database connections, and third-party API quotas for all users. OWASP API Security Top 10 2023 API4 (Unrestricted Resource Consumption) identifies per-user rate limiting as the primary control against API abuse. CWE-770 (Allocation of Resources Without Limits) covers the structural gap. Beyond resource exhaustion, unthrottled authenticated endpoints expose LLM token costs, external API call charges, and email sending quotas to abuse by any valid user. Competitors, scrapers, and compromised accounts can all trigger cost events at scale without rate limiting.

Key your rate limiter on user.id, not IP address, so that authenticated users can't bypass limits by rotating IPs. Return a Retry-After header so well-behaved clients back off correctly.

// src/lib/rate-limit.ts
import { Ratelimit } from '@upstash/ratelimit'
import { Redis } from '@upstash/redis'

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(100, '1m'),  // 100 req/min per user
})

export async function checkRateLimit(userId: string) {
  const { success, reset } = await ratelimit.limit(`user:${userId}`)
  if (!success) {
    throw Object.assign(new Error('Rate limit exceeded'), {
      status: 429,
      retryAfter: Math.ceil((reset - Date.now()) / 1000)
    })
  }
}

Call checkRateLimit(user.id) at the top of any route handler before executing business logic.