Registry / auth-security / express-brute

express-brute

library1.0.1jsnpmunverified

A brute-force protection middleware for Express.js that rate-limits incoming requests using a Fibonacci sequence for increasing delays. Current stable version is 1.0.1. It provides flexible options like freeRetries, minWait, maxWait, lifetime, and custom failure callbacks. The package supports various persistent stores (e.g., Memcached, Redis) via community modules, and includes built-in MemoryStore for development. It is released under the MIT license.

auth-security web-framework http-networking

npm install express-brute

github ↗package ↗

INSTALL

IMPORT

SIG · EXPRESS-BRUTE

express-brute

auth-securityjavascriptv1.0.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

ExpressBrute

✓ const ExpressBrute = require('express-brute');

✗ import ExpressBrute from 'express-brute';

express-brute is a CommonJS package; it does not provide ESM exports. Use require() in Node.js.

ExpressBrute.MemoryStore

✓ const store = new ExpressBrute.MemoryStore();

✗ import { MemoryStore } from 'express-brute';

MemoryStore is a property of the ExpressBrute constructor, not a named export.

ExpressBrute.FailTooManyRequests

✓ const bruteforce = new ExpressBrute(store, { failCallback: ExpressBrute.FailTooManyRequests });

✗ const bruteforce = new ExpressBrute(store, { failCallback: 'FailTooManyRequests' });

FailTooManyRequests is a built-in callback function, not a string. It returns HTTP 429 status.

Sets up a basic Express server with express-brute to rate-limit the /auth route, using MemoryStore and a Fibonacci backoff.

const express = require('express'); const ExpressBrute = require('express-brute'); const app = express(); const store = new ExpressBrute.MemoryStore(); // only for development, use persistent store in production const bruteforce = new ExpressBrute(store, { freeRetries: 2, minWait: 500, // milliseconds maxWait: 15 * 60 * 1000, // 15 minutes failCallback: ExpressBrute.FailTooManyRequests }); app.post('/auth', bruteforce.prevent, (req, res) => { res.send('Success!'); } ); app.listen(3000);

Debug

Known issues

breakingproxyDepth option removed in v1.0.0; use app.set('trust proxy', x) instead.

fix

Remove proxyDepth option from ExpressBrute constructor and set trust proxy via app.set('trust proxy', <value>).

affects: >=1.0.0

breakinggetIPFromRequest method removed in v1.0.0; use req.ip instead.

fix

Replace any calls to instance.getIPFromRequest(req) with req.ip.

affects: >=1.0.0

deprecatedExpress 3.x support dropped; peer dependency is express 4.x.

fix

Upgrade your project to use Express 4.x.

affects: >=1.0.0

gotchaMemoryStore should not be used in production; it does not persist across server restarts.

fix

Use a persistent store like express-brute-memcached, express-brute-redis, or express-brute-mongoose.

affects: all

breakingIn v0.6.0, .reset callbacks are always called asynchronously, even with MemoryStore.

fix

Ensure any code relying on synchronous callback execution is updated to handle async behavior.

affects: >=0.6.0

gotchaDefault failCallback is ExpressBrute.FailForbidden which returns 403; consider using FailTooManyRequests for 429.

fix

Explicitly set failCallback: ExpressBrute.FailTooManyRequests in options for proper rate-limit status code.

affects: all

Errors

Common errors & fixes

Error: Cannot find module 'express-brute'

Package not installed or not in node_modules.

fix

Run 'npm install express-brute' in your project directory.

TypeError: ExpressBrute.MemoryStore is not a constructor

Importing incorrectly with ES module syntax or destructuring.

fix

Use 'const ExpressBrute = require('express-brute');' then 'new ExpressBrute.MemoryStore();'.

Error: Most persistent stores cannot find the session store.

Using MemoryStore in production or missing peer dependencies for your chosen store.

fix

Install a persistent store module (e.g., 'npm install express-brute-memcached') and use its store constructor.

Upgrade

Version history

1.0.1latest on npm

Audit

Dependencies

expressrequiredPeer dependency: Express 4.x is required to use the middleware.

Agent activity

22 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/AdamPflug/express-brute ↗

packagehttps://www.npmjs.com/package/express-brute ↗