Api Rate Abuse in Nestjs with Firestore

Rate abuse in a NestJS application backed by Firestore typically occurs when an endpoint does not enforce limits on request frequency per identity or IP. Without controls, an attacker can call write-heavy endpoints many times per second, causing excessive document reads/writes and consuming Firestore operations. This can degrade performance, increase costs, and amplify other findings such as missing property-level authorization if the endpoint exposes user data by ID.

NestJS does not apply rate limiting by default. If you add a global or controller-level rate limiter (for example using an external store like Redis or an in-memory token bucket), you must ensure the limiter key is stable and does not leak information that could assist an attacker. Firestore itself does not provide request throttling at the database level for your application; it will accept and charge for every operation the backend submits. Therefore, the combination of an unthrottled NestJS route and Firestore as the datastore creates a clear abuse surface: repeated authenticated or unauthenticated calls can trigger high-volume document reads or writes, potentially triggering noisy neighbor effects or unexpected billing spikes.

Common patterns that increase risk include:

• Endpoints that accept user-controlled identifiers (e.g., userId, documentId) without first validating scope and authorization, enabling BOLA/IDOR alongside rate abuse.
• Unbounded loops or recursive reads in service code that can be triggered repeatedly to read many documents.
• Missing or weak per-identity rate tracking, allowing an attacker to rotate identifiers to bypass simple IP-based limits.

Because middleBrick scans the unauthenticated attack surface, it can detect missing rate-limiting defenses on public endpoints and highlight the absence of request caps as a finding. The scanner evaluates whether the API includes controls such as numeric thresholds, time windows, and identity-aware keys, and reports gaps. Without these controls, an API can be more easily driven into high-volume states that stress Firestore operations and expose sensitive data through side channels or insufficient authorization checks.

To remediate rate abuse when using Firestore in NestJS, implement rate limiting at the route level and reduce unnecessary document operations. Use a robust store for tracking request counts so limits cannot be trivially bypassed by changing IP or identity.

Example: a rate-limited endpoint that reads a user document only within the caller’s allowed scope:

import { Injectable, NestMiddleware } from '@nestjs/common';
import { Request, Response, NextFunction } from 'express';
import { FirestoreService } from './firestore.service';

@Injectable()
export class RateLimitMiddleware implements NestMiddleware {
  constructor(private readonly firestore: FirestoreService) {}

  async use(req: Request, res: Response, next: NextFunction): Promise {
    const identity = req.headers['x-user-id'] || req.ip;
    if (!identity) {
      res.status(400).send('Missing identity');
      return;
    }
    const allowed = await this.firestore.checkRateLimit(identity as string);
    if (!allowed) {
      res.status(429).send('Too many requests');
      return;
    }
    next();
  }
}

import { Injectable } from '@nestjs/common';
import { Firestore, doc, getDoc, updateDoc, runTransaction } from '@google-cloud/firestore';

@Injectable()
export class FirestoreService {
  constructor(private readonly firestore: Firestore) {}

  async checkRateLimit(identity: string): Promise {
    const windowSec = 60;
    const maxRequests = 100;
    const key = `rate_limit/${identity}`;
    const docRef = doc(this.firestore, key);

    return runTransaction(this.firestore, async (transaction) => {
      const snap = await transaction.get(docRef);
      const now = Date.now();
      const cutoff = now - windowSec * 1000;
      let record = snap.data() || { count: 0, lastRequest: now, history: [] };

      // Prune old entries
      record.history = (record.history || []).filter((ts: number) => ts >= cutoff);
      const currentCount = record.history.length;

      if (currentCount >= maxRequests) {
        return false;
      }

      record.history.push(now);
      transaction.set(docRef, record, { merge: true });
      return true;
    });
  }

  async getUserDocument(userId: string): Promise {
    const userRef = doc(this.firestore, 'users', userId);
    const snap = await getDoc(userRef);
    if (!snap.exists()) {
      throw new Error('Not found');
    }
    return snap.data();
  }
}