trpc-rate-limiter

Rate limiting function for tRPC. For defining in the trpc middleware which producers should be limited and at what rate.

This library currently only works for the Hono backend framework. Please create an issue if you wish it for another framework.

Installation

1# Using npm/yarn/pnpm/bun
2npm add @trpc-rate-limiter/hono

Usage

Rest APIs

1import { AppRouter } from "./router";
2import { trpcRateLimiter } from "@trpc-rate-limiter/hono";
3
4// You can define tiers for reuse
5export const RateLimitTier = {
6  BASIC: { windowMs: 60_000, limit: 5 },
7  STANDARD: { windowMs: 15 * 60 * 1000, limit: 10 },
8  PREMIUM: { windowMs: 60 * 60 * 1000, limit: 30 },
9};
10
11// // Time constants for better readability
12const MINUTE_IN_MS = 60 * 1000;
13const HOUR_IN_MS = 60 * MINUTE_IN_MS;
14
15// Create a tRPC middleware
16const rateLimiterMiddleware = t.middleware(async ({ ctx, next }) => {
17  // Extract the Hono Context
18  // Make sure that you have created a tRPC context (https://trpc.io/docs/server/context)
19  // and have passed the Hono context so that it can be extracted here
20  const { c } = ctx;
21
22  // Pass the type of your tRPC router for type safety
23  await trpcRateLimiter<AppRouter>({
24    config: {
25      "auth.signUp": {
26        windowMs: 15 * MINUTE_IN_MS, // 15m
27        limit: 5,
28      },
29      "auth.signIn": {
30        windowMs: 5 * MINUTE_IN_MS, // 5m
31        limit: 5,
32      },
33      "auth.requestPasswordReset": {
34        windowMs: 1 * HOUR_IN_MS, // 1h
35        limit: 3,
36      },
37      // Default tier applied to all other procedures
38      default: RateLimitTier.BASIC,
39    },
40    // Custom key generator function
41    // If not provided, it defaults to using the procedure path and IP
42    // You can customize this to use any identifier you prefer
43    keyGenerator: (c, path) => `${path}:${<userId>}`,
44  })(c);
45
46  return next();
47});

Data Stores

By default, MemoryStore is used. However, in order to synchronize the hit counts across instances, an external storage should be used.

If you deploy your service serverless or with multiple process or servers, then you need an external storage to store the hit counts.

The following stores are supported:

Name	Description
MemoryStore	(default) Simple in-memory option. Does not share state when the app has multiple processes or servers.
@trpc-rate-limiter/cloudflare	A Cloudflare-backed store, used with Durable Object and WorkersKV.
@hono-rate-limiter/redis	A Redis-backed store, used with @vercel/kv and @upstash/redis .
rate-limit-redis	A Redis-backed store, more suitable for large or demanding deployments.
rate-limit-postgresql	A PostgreSQL-backed store.
rate-limit-memcached	A Memcached-backed store.
cluster-memory-store	A memory-store wrapper that shares state across all processes on a single server via the node:cluster module. Does not share state across multiple servers.
precise-memory-rate-limit	A memory store similar to the built-in one, except that it stores a distinct timestamp for each key.
typeorm-rate-limit-store	Supports a variety of databases via TypeORM: MySQL, MariaDB, CockroachDB, SQLite, Microsoft SQL Server, Oracle, SAP Hana, and more.
@rlimit/storage	A distributed rlimit store, ideal for multi-regional deployments.

Take a look at this guide if you wish to create your own store.

Notes

• The keyGenerator function determines what to limit a request on, it should represent a unique characteristic of a user or class of user that you wish to rate limit. Good choices include API keys in Authorization headers, URL paths or routes, specific query parameters used by your application, and/or user IDs.
• It is not recommended to use IP addresses (since these can be shared by many users in many valid cases) or locations (the same), as you may find yourself unintentionally rate limiting a wider group of users than you intended.

Credits

The trpc-rate-limiter project is a fork of hono-rate-limiter, adapted for tRPC integration. The original hono-rate-limiter project was inspired by express-rate-limit.