express-limit

express-limit is a small project that add rate limitations to your API.

Installation

1npm install --save express-limit

Usage

1const limit = require("express-limit").limit;
2
3app.get(
4  "/api/users",
5  limit({
6    max: 5, // 5 requests
7    period: 60 * 1000, // per minute (60 seconds)
8  }),
9  function (req, res) {
10    res.status(200).json({});
11  }
12);

Options

1{
2  (max = 60), // Maximum request per period
3    (period = 60 * 1000), // Period in milliseconds
4    (prefix = "rate-limit-"), // Prefix of the key
5    (status = 429), // Status code in case of rate limit reached
6    (message = "Too many requests"), // Message in case of rate limit reached
7    (identifier = (request) => {
8      // The identifier function/value of the key (IP by default, could be "req.user.id")
9      return request.ip || request.ips; // Read from Default properties
10    }),
11    (headers = {
12      // Headers names
13      remaining: "X-RateLimit-Remaining",
14      reset: "X-RateLimit-Reset",
15      limit: "X-RateLimit-Limit",
16    }),
17    (store = new Store()); // The storage, default storage: in-memory
18}

In some cases, you could want to skip the limitation you made for trusted client. In this case, you can add a special field in the request object:

1req._skip_limits = true;

Also, you could want to add specific limitations for a special client. In this case, you can add a special field in the request object:

1req._custom_limits = {
2  max: 1000, // 1000 requests
3  period: 60 * 1000, // per minutes
4};

Just don't forget where you place this modification! It could be applied for all routes!

Available Stores

Actually, two stores have been made:

• InMemoryStore (default store, nothing to do)

1const RateLimiter = require("express-limit").RateLimiter;
2const InMemoryStore = require("express-limit").InMemoryStore;
3
4const store = new InMemoryStore();
5
6const limit = (options = {}) => {
7  options.store = store;
8
9  return new RateLimiter(options).middleware;
10};
11
12app.get(
13  "/api/users",
14  limit({
15    max: 5, // 5 requests
16    period: 60 * 1000, // per minute (60 seconds)
17  }),
18  function (req, res) {
19    res.status(200).json({});
20  }
21);

• RedisStore

1const redis = require("redis");
2const client = redis.createClient();
3
4const RateLimiter = require("express-limit").RateLimiter;
5const RedisStore = require("express-limit").RedisStore;
6
7const store = new RedisStore(client);
8
9const limit = (options = {}) => {
10  options.store = store;
11
12  return new RateLimiter(options).middleware;
13};
14
15app.get(
16  "/api/users",
17  limit({
18    max: 5, // 5 requests
19    period: 60 * 1000, // per minute (60 seconds)
20  }),
21  function (req, res) {
22    res.status(200).json({});
23  }
24);

• RedisLegacyStore (node-redis v3 or node-redis v4 with legacyMode true)

1const redis = require("redis");
2const client = redis.createClient({
3  legacyMode: true,
4});
5
6const RateLimiter = require("express-limit").RateLimiter;
7const RedisLegacyStore = require("express-limit").RedisLegacyStore;
8
9const store = new RedisLegacyStore(client);
10
11const limit = (options = {}) => {
12  options.store = store;
13
14  return new RateLimiter(options).middleware;
15};
16
17app.get(
18  "/api/users",
19  limit({
20    max: 5, // 5 requests
21    period: 60 * 1000, // per minute (60 seconds)
22  }),
23  function (req, res) {
24    res.status(200).json({});
25  }
26);

Keep in touch!