Usage
Importing the Library
This library requires node version 16 or above.
This library is provided in esm as well as cjs forms, and works with both Javascript and Typescript projects.
Using the Library
The rateLimit
function accepts an options object and returns the rate limiting
middleware.
An example with the recommended configuration is as follows:
const limiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
legacyHeaders: false, // Disable the `X-RateLimit-*` headers
})
Then use it in your Express application as follows:
app.use(limiter)
To use it only for a certain path (e.g., limit only calls to the /auth/*
endpoints), specify the url as the first parameter in app.use
:
app.use('/auth', limiter)
To use it only for a certain endpoint (e.g., limit calls to
POST /reset_password
), add the limiter as a middle argument to
app.get
/app.post
/etc.:
app.post('/reset_password', limiter, (req, res) => {
// ...
})
Take a look at the configuration page for a list of options you can use to change the behaviour of the limiter.
If your server runs behind a proxy/load balancer, the IP address of the request
might be undefined
, or the IP of the load balancer/reverse proxy (leading to
the rate limiter blocking all requests once the limit is reached).
To fix this, take a look at the guide to troubleshooting proxy issues.
Using External Stores
A store is essentially a javascript/typescript class that allows the library to store hit counts and reset times for clients wherever you want, e.g., in an external database.
To use an external store, pass an instance of the store to the rateLimit
function, like so:
const limiter = rateLimit({
// ... other options,
store: new ExternalStore(),
})
For a list of stores you can use, take a look at the data stores page.
For a tutorial on how to create your own store, see this.