GitHub

2.91k

express-rate-limit/express-rate-limit

Created 10 years ago, last commit a month ago

64 contributors

747 commits

Stars added on GitHub, month by month

Click on the bars to view the numbers

+25

+28

+33

+17

+40

+41

+23

+25

+39

+33

+23

+19

Nov

11

Dec

12

Jan

1

Feb

2

Mar

3

Apr

4

May

5

Jun

6

Jul

7

Aug

8

Sep

9

Oct

10

2023

2024

Stars added on GitHub, per day, on average

Yesterday

+2

Last week

+1.6

/day

Last month

+0.9

/day

Last 12 months

+0.9

/day

Package on NPM

express-rate-limit

7.4.1

Monthly downloads on NPM

Click on the bars to view the numbers

11.7M

8.6M

7.29M

6.44M

6.96M

4.79M

4.41M

4.29M

5.11M

5.02M

5.38M

6.11M

Nov

11

Dec

12

Jan

1

Feb

2

Mar

3

Apr

4

May

5

Jun

6

Jul

7

Aug

8

Sep

9

Oct

10

2023

2024

No dependencies

README

`express-rate-limit`

Basic rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset. Plays nice with express-slow-down and ratelimit-header-parser.

Usage

The full documentation is available on-line.

import { rateLimit } from 'express-rate-limit'

const limiter = rateLimit({
	windowMs: 15 * 60 * 1000, // 15 minutes
	limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes).
	standardHeaders: 'draft-7', // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
	legacyHeaders: false, // Disable the `X-RateLimit-*` headers.
	// store: ... , // Redis, Memcached, etc. See below.
})

// Apply the rate limiting middleware to all requests.
app.use(limiter)

Data Stores

The rate limiter comes with a built-in memory store, and supports a variety of external data stores.

Configuration

All function options may be async. Click the name for additional info and default values.

Option	Type	Remarks
`windowMs`	`number`	How long to remember requests for, in milliseconds.
`limit`	`number` \| `function`	How many requests to allow.
`message`	`string` \| `json` \| `function`	Response to return after limit is reached.
`statusCode`	`number`	HTTP status code after limit is reached (default is 429).
`handler`	`function`	Function to run after limit is reached (overrides `message` and `statusCode` settings, if set).
`legacyHeaders`	`boolean`	Enable the `X-Rate-Limit` header.
`standardHeaders`	`'draft-6'` \| `'draft-7'`	Enable the `Ratelimit` header.
`store`	`Store`	Use a custom store to share hit counts across multiple nodes.
`passOnStoreError`	`boolean`	Allow (`true`) or block (`false`, default) traffic if the store becomes unavailable.
`keyGenerator`	`function`	Identify users (defaults to IP address).
`requestPropertyName`	`string`	Add rate limit info to the `req` object.
`skip`	`function`	Return `true` to bypass the limiter for the given request.
`skipSuccessfulRequests`	`boolean`	Uncount 1xx/2xx/3xx responses.
`skipFailedRequests`	`boolean`	Uncount 4xx/5xx responses.
`requestWasSuccessful`	`function`	Used by `skipSuccessfulRequests` and `skipFailedRequests`.
`validate`	`boolean` \| `object`	Enable or disable built-in validation checks.

Thank You

Sponsored by Zuplo a fully-managed API Gateway for developers. Add dynamic rate-limiting, authentication and more to any API in minutes. Learn more at zuplo.com

Thanks to Mintlify for hosting the documentation at express-rate-limit.mintlify.app

Finally, thank you to everyone who's contributed to this project in any way! 🫶

Issues and Contributing

If you encounter a bug or want to see something added/changed, please go ahead and open an issue! If you need help with something, feel free to start a discussion!

If you wish to contribute to the library, thanks! First, please read the contributing guide. Then you can pick up any issue and fix/implement it!