Project 3 — Sessions and Rate Limits

What you'll walk away with

Explain the core ideas behind Project 3 — Sessions and Rate Limits
Run the sample Redis command or code and verify its output
Apply the technique correctly to the Tutorial Platform and production scenarios

Build the mental model

An auth layer needs both session confidentiality and abuse prevention. Login may use IP-plus-account limits, authenticated APIs user limits, and expensive exports concurrency guards. Redis failure behavior must be chosen from endpoint risk rather than one global rule.

Connect it to a real scenario

Build secure cookies, hashed session keys, CSRF state, idle and absolute timeouts, and a logout-all index. Reuse a Lua fixed-window limiter with different login, search, and export policies. Store safe hashes and outcomes—not raw tokens or IPs—in audit logs.

Combine session security and abuse control
Use endpoint-specific limits
Choose failure behavior from risk

Try the working example

typescript

const session = await readSession(hash(cookie.sid));
if (!session) return reply.status(401).send();
const [count, ttl] = await evalRateLimit(`rl:export:${session.userId}`, 3600);
if (count > 5) return reply.status(429).header('Retry-After', ttl).send();
return createExport(session.userId);

You should see

Authenticated exports are protected by an hourly limit with clear retry behavior.

5-minute try-it

Choose and justify fail-open or fail-closed behavior for login, search, and exports when Redis is down.

One important caution

Avoid user enumeration by keeping limiter and error behavior consistent for known and unknown accounts.

Redis — Data Types — Redis

Easy traps

Avoid user enumeration by keeping limiter and error behavior consistent for known and unknown accounts.
Validate sample commands on a local or test instance with recoverable data before applying them to production Redis.

Exercise

Choose and justify fail-open or fail-closed behavior for login, search, and exports when Redis is down.

You'll know it worked when: Authenticated exports are protected by an hourly limit with clear retry behavior.