Registry / http-networking / express-rate-limit

express-rate-limit

library8.3.2jsnpmunverified

express-rate-limit is a middleware for Express.js that provides basic IP-based rate limiting to protect endpoints from abuse, such as brute-force attacks on login or password reset forms, or excessive API requests. The current stable version is 8.3.2, and the package maintains an active release cadence, with multiple minor and patch updates within recent months, indicating ongoing development and support. Key differentiators include its flexible configuration for `windowMs` and `limit`, support for various external data stores (beyond its built-in memory store), and compliance with the IETF RateLimit header specification (draft-6, draft-7, and draft-8), allowing for modern and standardized rate limiting headers. It also includes `ipv6Subnet` configuration for granular IPv6 handling and integrates well with related packages like `express-slow-down`.

http-networking auth-security web-framework

npm install express-rate-limit

github ↗package ↗

INSTALL

IMPORT

SIG · EXPRESS-RATE-LIMIT

express-rate-limit

http-networkingjavascriptv8.3.2

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

rateLimit

✓ import { rateLimit } from 'express-rate-limit'

✗ const rateLimit = require('express-rate-limit')

While CommonJS `require` still works, ESM `import` is the recommended and modern approach, especially for new projects. The package ships TypeScript types.

RateLimitRequestHandler

✓ import { type RateLimitRequestHandler } from 'express-rate-limit'

Type import for explicit TypeScript usage, enabling better type checking for middleware functions.

MemoryStore

✓ import { MemoryStore } from 'express-rate-limit'

✗ import { Store } from 'express-rate-limit'

The default store is `MemoryStore`. If you need to explicitly reference or extend it, use `MemoryStore`. `Store` is an interface/abstract class.

This quickstart demonstrates how to set up a basic rate limit for all requests under '/api/' using the `rateLimit` middleware, configuring its window, limit, and modern headers.

import express from 'express'; import { rateLimit } from 'express-rate-limit'; const app = express(); // Configure the rate limiter: 100 requests per IP every 15 minutes. const apiLimiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes limit: 100, // Max 100 requests per IP per window standardHeaders: 'draft-8', // Uses the latest IETF RateLimit header draft legacyHeaders: false, // Disables the older X-RateLimit-* headers message: 'Too many requests from this IP, please try again after 15 minutes.', // store: new RedisStore({ /* ... config ... */ }), // Example of an external store }); // Apply the rate limiting middleware to all API requests app.use('/api/', apiLimiter); // A public route that is not rate-limited app.get('/', (req, res) => { res.send('Welcome! This route is not rate-limited.'); }); // A rate-limited API endpoint app.get('/api/data', (req, res) => { res.json({ message: 'This is some data.' }); }); const PORT = process.env.PORT || 3000; app.listen(PORT, () => { console.log(`Server running on port ${PORT}`); });

Debug

Known issues

breakingVersion 8.0.0 introduced breaking changes. Specifically, the library shifted towards adhering more closely to IETF RateLimit header specifications. Review your configuration, especially `standardHeaders` and `legacyHeaders`.

fix

Consult the official changelog for v8.0.0. Update `standardHeaders` to 'draft-8' for the latest spec, or 'draft-6' for an older one. Set `legacyHeaders: false` to disable the deprecated `X-RateLimit-*` headers if not needed for backwards compatibility.

affects: >=8.0.0

gotchaBy default, `express-rate-limit` uses a `MemoryStore`. In production environments with multiple Node.js instances or processes, this can lead to inconsistent rate limiting as each instance will have its own independent hit count.

fix

For production deployments, configure an external `store` like Redis or Memcached to ensure consistent rate limiting across all instances. Refer to the 'Data Stores' section in the documentation.

affects: >=1.0.0

gotchaThe `ipv6Subnet` option is crucial for correctly identifying unique users on IPv6 networks. An incorrect setting can either be too aggressive (treating many users in a subnet as one) or too lenient (allowing more requests than intended).

fix

Carefully choose an appropriate `ipv6Subnet` value (e.g., 60 or 64 for typical home networks, 52 or 48 for more aggressive limiting) based on your network architecture and desired behavior. The default might not be suitable for all use cases.

affects: >=6.0.0

deprecatedThe traditional `X-RateLimit-*` headers are considered legacy. While still supported via the `legacyHeaders: true` option, the library encourages adoption of the IETF RateLimit header specification.

fix

Set `standardHeaders` to `'draft-8'` (or `'draft-6'/'draft-7'` if needed for older clients) and consider setting `legacyHeaders: false` to embrace the modern standard. Inform clients about the header change.

affects: >=7.5.0

Errors

Common errors & fixes

TypeError: rateLimit is not a function

Attempting to use `new rateLimit()` or incorrectly importing the function, especially in CommonJS where the default export might be expected directly.

fix

Ensure you are using named import: `import { rateLimit } from 'express-rate-limit'` for ESM, or `const { rateLimit } = require('express-rate-limit')` for CommonJS. Do not use `new` with `rateLimit`.

Error: Store must be defined (if using a custom store with 'store' option)

The `store` option was specified but its value was `undefined` or `null`, often due to an uninitialized external store instance.

fix

Ensure that the `store` option is provided with an instantiated store object, e.g., `store: new RedisStore({ client: redisClient })`.

Rate limiting not being applied or not working as expected (e.g., still receiving 200 OK after many requests)

The middleware might be applied globally when it should be route-specific, or vice-versa, or applied in the wrong order in your Express middleware chain.

fix

Verify that `app.use(limiter)` is called *before* the routes you intend to limit. If limiting specific routes, apply `app.get('/route', limiter, handler)` instead of globally. Check your `windowMs` and `limit` values are not excessively high.

Upgrade

Version history

8.3.2latest on npm

Audit

Dependencies

expressrequiredPeer dependency, as this is an Express middleware.

Agent activity

27 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/express-rate-limit/express-rate-limit ↗

packagehttps://www.npmjs.com/package/express-rate-limit ↗