API Rate Limits Differentiated by Role

A single global rate limit applied identically to free users, paid users, and admins means the limit must be conservative enough for the most restricted tier — which throttles legitimate premium users — or generous enough for heavy users — which provides no abuse protection for the free tier. CWE-284 (Improper Access Control) covers the failure to differentiate resource access by privilege level. OWASP A01 (Broken Access Control) and NIST 800-53 AC-6 (Least Privilege) require that access controls reflect the actual entitlement model, which for API rate limits means tier-aware limits that match the product's promise to each user segment.

Implement tiered rate limits keyed by the user's subscription plan. Free, pro, and admin tiers each get limits appropriate to their entitlement.

// lib/rate-limit.ts
import { Ratelimit } from '@upstash/ratelimit';

const limits = {
  free: new Ratelimit({ redis, limiter: Ratelimit.slidingWindow(50, '1 h') }),
  pro:  new Ratelimit({ redis, limiter: Ratelimit.slidingWindow(500, '1 h') }),
  admin: new Ratelimit({ redis, limiter: Ratelimit.slidingWindow(5000, '1 h') }),
};

export async function applyRateLimit(userId: string, plan: 'free' | 'pro' | 'admin') {
  const { success } = await limits[plan].limit(userId);
  return success;
}

Derive the plan from the authenticated session — never from a user-supplied header or query parameter.