npmpackage.info

Gathering detailed insights and metrics for @joeweale/rate-limit-mongo

@joeweale/rate-limit-mongo - 2.4.0 | npmpackage.info

@joeweale/rate-limit-mongo

A MongoDB store for express-rate-limit middleware

2.4.0

JavaScript

11.67 kB

2.5

Installations

npm install @joeweale/rate-limit-mongo

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Node Version

14.15.1

NPM Version

6.14.8 Pull Requests

Open

4

Total

30

Closed

5

Merged

21

Issues

Open

4

Total

16

Closed

12

Releases

Unable to fetch releases

Languages

JavaScript

JavaScript (100%)

Developer

2do2go

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

32 Stars

133 Commits

11 Forks

3 Watchers

3 Branches

5 Contributors

Updated on Jan 25, 2023

Maintainers

View All 5 Contributors

Package Meta Information

Latest Version

2.4.0

Package Id

@joeweale/rate-limit-mongo@2.4.0

Unpacked Size

11.67 kB

Size

3.93 kB

File Count

NPM Version

6.14.8

Node Version

14.15.1

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

mongodb twostep underscore

Dev Dependencies

expect.js jshint mocha nyc rewire sinon

Rate Limit Mongo

MongoDB store for the express-rate-limit middleware.

Install

1$ npm install --save rate-limit-mongo

Usage

1var RateLimit = require('express-rate-limit');
2var MongoStore = require('rate-limit-mongo');
3
4var limiter = new RateLimit({
5  store: new MongoStore({
6    uri: 'mongodb://127.0.0.1:27017/test_db',
7    user: 'mongouser',
8    password: 'mongopassword',
9    // should match windowMs
10    expireTimeMs: 15 * 60 * 1000,
11    errorHandler: console.error.bind(null, 'rate-limit-mongo')
12    // see Configuration section for more options and details
13  }),
14  max: 100,
15  // should match expireTimeMs
16  windowMs: 15 * 60 * 1000
17});
18
19//  apply to all requests
20app.use(limiter);

Configuration

uri: string -- uri for connecting to mongodb, mongodb://127.0.0.1:27017/test_db for example. Required if collection hasn't been set.
collectionName: string -- name of collection for storing records. Defaults to expressRateRecords
user: string -- username for authentication in mongodb
password: string -- password for authentication in mongodb
authSource: string -- db name against which authenticate use. If not set db name from uri will be taken.
collection: object -- mongodb collection instance. Required if uri hasn't been set.
connectionOptions: object -- mongodb connection options. Allows to pass additional connection options to mongodb. The default connection options are useUnifiedTopology: true, useNewUrlParser: true.
expireTimeMs: integer -- time period, in milliseconds, after which record will be reset (deleted). Defaults to 60 * 1000. Notice that current implementation uses on mongodb ttl indexes - background task that removes expired documents runs every 60 seconds. As a result, documents may remain in a collection during the period between the expiration of the document and the running of the background task. See mongodb ttl indexes doc for more information.

Note: unless express-tate-limit's headers are disabled, windowMs on express-tate-limit's options should be set to the same value as expireTimeMs on rate-limit-mongo's options in order for the Retry-After header to be correct.

resetExpireDateOnChange: boolean -- indicates whether expireDate should be reset when changed or not. Defaults to false.
errorHandler: function -- function that will be called if error happened during incr, decrement or resetKey methods. Defaults to _.noop.
createTtlIndex: boolean -- defines whether create ttl index ( on expirationDate field with expireAfterSeconds: 0) on collection or not. Could be useful in situations when you don't want to create index from the app e.g. due to restricted db permissions (see #15 for details). Defaults to true.

Methods

MongoStore class provides public methods (incr, decrement, resetKey) required by express-rate-limit.

In addition following methods provided:

getClient(callback) - if collection was not passed to the constructor then that method will pass (as second argument) initiated instace of MongoClient to the callback, otherwise null will be passed. Thus this method provides control over connection initiated by the library to the end user. This method is promisified (when util.promisify is presented (node.js >= 8)).

No vulnerabilities found.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

4

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 4

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-linux.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-linux.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-linux.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-linux.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-linux.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-linux.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-mac-win.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-mac-win.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-current-lts-mac-win.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-current-lts-mac-win.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-legacy.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-legacy.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-legacy.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-legacy.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-main.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-main.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs-main.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/2do2go/rate-limit-mongo/nodejs-main.yml/master?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/nodejs-legacy.yml:23
Info: 0 out of 8 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 1 third-party GitHubAction dependencies pinned
Info: 3 out of 4 npmCommand dependencies pinned

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

License

Determines if the project has defined a license.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

2.5

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More