Hardening Mobile Apps & SaaS Backend APIs against Reverse Engineering & Layer 7 Attacks

import Redis from 'ioredis';
const redis = new Redis(process.env.REDIS_URL || 'redis://127.0.0.1:6379');

export async function isRateLimited(key: string, limit = 60, windowSec = 60): Promise<boolean> {
  const now = Date.now();
  const clearBefore = now - (windowSec * 1000);
  const pipeline = redis.pipeline();
  pipeline.zremrangebyscore(key, 0, clearBefore);
  pipeline.zadd(key, now, String(now));
  pipeline.zcard(key);
  pipeline.expire(key, windowSec);
  const results = await pipeline.exec();
  const requestCount = results?.[2]?.[1] as number;
  return requestCount > limit;
}