A rate limit in ten lines, in front of the code

The /reports endpoint costs eleven seconds of CPU per call, and one customer's retry loop found it. You need a rate limit, and the honest options were all heavy: middleware in the app means a deploy, an API gateway means a product, edge rules mean config you'll maintain forever.

On Hoody you register a proxy hook: match POST /reports*, route through a script. The script counts requests per client in shared state and returns 429 above the threshold. Everything else forwards untouched with one call. The backend never sees the flood: the hook rejects before the expensive code runs.

Ten lines of JavaScript, deployed by writing a file. The limiter went in front of the code, not into it.

The limiter went in front of the code, not into it.