ThinkBoard

Why

I wanted a small app where I owned every layer, so I could follow a single request from a button click to the database and back.

What I built

1. 01

   Built the React interface and Express API for full create, read, update, and delete on notes.

2. 02

   Added Upstash Redis sliding-window rate limiting as Express middleware: 50 requests per 60 seconds, then HTTP 429.

3. 03

   Handled 429 in the interface with a dedicated rate-limited screen instead of a generic error.

4. 04

   Required title and content in both the form and the Mongoose schema, and added toast messages so every create, edit, and delete reports its result.

The code

// config/upstash.js: 50 requests per 60 seconds, sliding window
const rateLimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(50, "60 s"),
});

// middleware/rateLimiter.js
const ratelimiter = async (req, res, next) => {
  try {
    const { success } = await ratelimit.limit("my-rate-limit");
    if (!success) {
      return res.status(429).json({
        message: "Too many requests, please try again later",
      });
    }
    next();
  } catch (error) {
    next(error);
  }
};

Outcome

A working notes app where every action gives clear feedback, and the API protects itself (and the Upstash free tier) from bursts of requests.

What I learned

A rate limiter is only as fair as its key. Choosing what to count matters as much as the limit itself.

What I'd fix next

Key the limiter by IP, and return 400 with the field name when Mongoose validation fails. Right now a missing title falls through to a generic 500.

Go deeper