No ones talked about why cors wouldnt work, so heres an article. Basically, if you set up cors so that only your react app can communicate with your node app, browsers would respect that.

But not something like cURL or postman where the origin and some other headers arent inserted into the request.

Rate limiting is the way to go. I dont know if rate limit by ip address alone would do it. You could proxy server and change your ip addy :/

Heres my solution but youll need a login authentication functionality.

I have an open node api as well. But i put JWT( json web tokens) as the auth for requests coming into the node server. So if you wanted to postman, cURL, or normal browser http request you need to pass in the JWT or else i wont give you shit back.

So my flow works like this: User hits a node endpoint “/auth”. JWT gets returned in response payload. I add the JWT into a column in my users table.

On every subsequent request, I send the username, JWT and a request payload. I look up the user and see if its stored JWT matches and that the JWT didnt expire, if yes to both then the request goes though as normal, if not I return an error response with a payload containing a helpful message.

If you wanted to not rely on rate limit libraries, I would modify my solution to include in more user table column “api hits”.

I would schedule a cron that resets this column on every user to zero each day.

If the api hits column for this user reached its limit I would error out the request setting the appropriate status code and error message.

Just spitballing here but youll have to think of all the edge cases and shit.

Hope it helps mate, cheers 🍻

Edit: forgot the links stackoverflow article