express-rate-limit

Basic IP rate-limiting middleware for Express — protect your API endpoints from brute-force and denial-of-service attacks.

express-rate-limit

Express

Basic IP rate-limiting middleware for Express — protect your API endpoints from brute-force and denial-of-service attacks.

npm GitHub Docs

Fit

Bundle (gzip)

12.1 kB

40.1 kB raw

Install size includes transitive dependencies. Bundle size is gzipped browser payload.

Freshness

The Problem

Without rate limiting, login endpoints are vulnerable to brute-force attacks and public APIs can be abused by bots. Implementing per-IP request counting with window resets requires custom middleware and a backing store.

What It Does

express-rate-limit counts requests per IP within a time window and responds with 429 Too Many Requests when the limit is exceeded. Rate limit info is exposed via response headers. Pluggable stores (Redis, Memcached) enable rate limiting across multiple server instances.

Installation

bash

npm install express-rate-limit

Usage Example

typescript

import rateLimit from 'express-rate-limit';

// Strict limit for auth routes
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 10,
  message: { error: 'Too many login attempts, please try again later.' },
  standardHeaders: true,
  legacyHeaders: false,
});

// General API limit
const apiLimiter = rateLimit({ windowMs: 60 * 1000, max: 100 });

app.use('/api', apiLimiter);
app.use('/api/auth/login', authLimiter);

Related packages

body-parserExpress

Node.js body parsing middleware — populate `req.body` from JSON, urlencoded, text, and raw payloads.

compressionExpress

HTTP response compression middleware for Express — gzip/deflate responses to reduce bandwidth and improve load times.

cookie-parserExpress

Cookie parsing middleware for Express — parse Cookie headers into `req.cookies` and support signed cookies for tamper detection.

corsExpress

CORS middleware for Express — configure cross-origin resource sharing with a single line of code.

express-async-errorsExpress

Simplify Express error handling by automatically passing thrown errors to `next()`.