Skip to main content

Express Rate Limiting

Introduction​

Rate limiting is a crucial security technique that helps protect your Express.js applications from abuse, brute-force attacks, and potential denial-of-service (DoS) scenarios. It works by controlling the number of requests a user can make to your API within a specified timeframe.

Think of rate limiting as a traffic controller for your API. Just like a traffic light prevents congestion by controlling the flow of vehicles, rate limiting prevents server overload by controlling the flow of incoming requests.

In this guide, we'll explore how to implement rate limiting in Express applications, understand different rate limiting strategies, and see how it can be used in real-world scenarios to protect your web services.

Why Rate Limiting Is Important​

Before diving into implementation, let's understand why rate limiting matters:

  • Prevents Abuse: Stops malicious users from overwhelming your server with requests
  • Protects Resources: Ensures fair resource distribution among all users
  • Reduces Costs: Helps control bandwidth and server costs by limiting excessive usage
  • Improves Reliability: Keeps your application responsive during traffic spikes
  • Discourages Scraping: Makes it difficult for others to scrape your content at scale

Basic Rate Limiting with Express-Rate-Limit​

The most popular package for implementing rate limiting in Express is express-rate-limit. Let's see how to use it.

Step 1: Install the package​

bash
npm install express-rate-limit

Step 2: Set up basic rate limiting​

javascript
const express = require('express');
const rateLimit = require('express-rate-limit');

const app = express();

// Create the rate limit rule
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
  legacyHeaders: false, // Disable the `X-RateLimit-*` headers
  message: 'Too many requests from this IP, please try again after 15 minutes'
});

// Apply the rate limiting middleware to all requests
app.use(limiter);

app.get('/', (req, res) => {
  res.send('Hello World!');
});

app.listen(3000, () => {
  console.log('Server running on port 3000');
});

In this example:

  • windowMs defines the timeframe (15 minutes)
  • max specifies how many requests are allowed in that timeframe (100)
  • message is what gets sent when a user exceeds the limit

Response Headers​

When rate limiting is applied, the following headers are sent with each response:

RateLimit-Limit: 100
RateLimit-Remaining: 99
RateLimit-Reset: 1620000000

These headers inform clients about their current usage status.

Different Rate Limiting Strategies​

Route-Specific Rate Limiting​

You might want different limits for different routes. For example, apply stricter limits on authentication endpoints to prevent brute force attacks:

javascript
// Stricter rate limit for login attempts
const loginLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 5, // 5 requests per hour
  message: 'Too many login attempts, please try again after an hour'
});

// Apply to login route
app.post('/login', loginLimiter, (req, res) => {
  // Login logic
});

// Regular routes use the default limiter
app.get('/dashboard', (req, res) => {
  res.send('Dashboard');
});

Dynamic Rate Limiting​

Sometimes you want different limits for different users. For example, allow more requests for premium users:

javascript
const dynamicLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: (req, res) => {
    if (req.user && req.user.isPremium) {
      return 500; // Premium users get 500 requests
    }
    return 100; // Regular users get 100 requests
  },
  keyGenerator: (req) => {
    // Use user ID instead of IP for authenticated users
    return req.user ? req.user.id : req.ip;
  }
});

app.use(dynamicLimiter);

Advanced Configuration Options​

Express-rate-limit provides several configuration options to customize its behavior:

Custom Storage​

By default, express-rate-limit uses in-memory storage, which isn't ideal for production applications with multiple servers. For production, you should use Redis or another shared storage:

javascript
const RedisStore = require('rate-limit-redis');
const Redis = require('ioredis');

const limiter = rateLimit({
  store: new RedisStore({
    // Connect to Redis
    client: new Redis({
      host: 'localhost',
      port: 6379
    }),
    // Key prefix in Redis (to avoid collision with other data)
    prefix: 'rate-limit:'
  }),
  windowMs: 15 * 60 * 1000,
  max: 100
});

app.use(limiter);

Skip Function​

You might want to bypass rate limiting for certain requests:

javascript
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  // Skip rate limiting for admin IPs
  skip: (req) => {
    const adminIPs = ['192.168.1.1', '10.0.0.1'];
    return adminIPs.includes(req.ip);
  }
});

app.use('/api', apiLimiter);

Real-World Example: API Rate Limiting​

Let's look at a more complete example that implements rate limiting for a REST API:

javascript
const express = require('express');
const rateLimit = require('express-rate-limit');

const app = express();

// Parse JSON requests
app.use(express.json());

// Configure different rate limits
const generalLimiter = rateLimit({
  windowMs: 60 * 60 * 1000, // 1 hour
  max: 1000, // 1000 requests per hour
  message: { error: 'Request limit exceeded. Try again in an hour.' }
});

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 login attempts per 15 minutes
  message: { error: 'Too many login attempts. Try again later.' }
});

// Apply general rate limiting to all routes
app.use(generalLimiter);

// Apply stricter limits to authentication routes
app.post('/api/login', authLimiter, (req, res) => {
  // Login logic
  res.json({ success: true, message: 'Login successful' });
});

app.post('/api/register', authLimiter, (req, res) => {
  // Registration logic
  res.json({ success: true, message: 'Registration successful' });
});

// API endpoints
app.get('/api/users', (req, res) => {
  res.json({ users: ['John', 'Jane', 'Bob'] });
});

app.post('/api/data', (req, res) => {
  // Process data
  res.json({ success: true, data: req.body });
});

// Error handler
app.use((err, req, res, next) => {
  console.error(err);
  res.status(500).json({ error: 'Server error' });
});

app.listen(3000, () => {
  console.log('API server running on port 3000');
});

Best Practices for Rate Limiting​

  1. Set reasonable limits: Don't set limits too low that legitimate users get blocked, or too high that they don't protect your app.

  2. Communicate limits clearly: Add headers and clear messages to explain rate limits to API consumers.

  3. Use different limits for different endpoints: Apply stricter limits to sensitive endpoints like authentication.

  4. Consider user roles: Allow higher limits for premium or authenticated users.

  5. Use distributed storage: For production applications, use Redis or another distributed cache to share rate limit data across multiple servers.

  6. Monitor and adjust: Keep track of how often users hit rate limits and adjust as needed.

  7. Implement exponential backoff: Encourage clients to use progressive delays between retries.

Common Pitfalls and Solutions​

Problem: Rate limiting by IP in environments with shared IPs​

When multiple users share the same IP address (like in corporate networks or when behind a proxy), rate limiting by IP can accidentally block legitimate users.

Solution: Use a combination of IP and user identifiers when possible:

javascript
const limiter = rateLimit({
  keyGenerator: (req) => {
    // Use user ID if authenticated, otherwise IP
    return req.user ? req.user.id : req.ip;
  },
  windowMs: 15 * 60 * 1000,
  max: 100
});

Problem: Dealing with proxy servers​

When your app is behind a proxy, the client's real IP might be lost.

Solution: Make sure Express is configured to trust the proxy:

javascript
// Make sure this is BEFORE any rate limiting middleware
app.set('trust proxy', 1);

Summary​

Rate limiting is an essential security feature for any Express.js application exposed to the public internet. It protects your server from abuse, prevents DoS attacks, and ensures fair resource allocation among users.

Key points to remember:

  • Use the express-rate-limit package for easy implementation
  • Configure different limits for different routes based on sensitivity
  • Use distributed storage in production environments
  • Consider user roles and context when setting limits
  • Clearly communicate limits to your API consumers

By implementing proper rate limiting, you significantly improve your application's security posture and reliability.

Additional Resources​

Exercises​

  1. Implement basic rate limiting on a simple Express API with at least 3 endpoints.
  2. Create different rate limits for authenticated and non-authenticated users.
  3. Set up Redis storage for rate limiting in a Node.js application.
  4. Build a system that returns progressively longer timeout periods for clients that repeatedly hit rate limits.
  5. Create a dashboard that displays rate limit statistics for your API.

Happy coding and remember, good rate limiting leads to happier servers and users!


If you spot any mistakes on this website, please let me know at [email protected]. I’d greatly appreciate your feedback! :)