Implementing Rate Limiting

npm i express-rate-limit rate-limit-redis ioredis

import rateLimit from "express-rate-limit";

const limiter = rateLimit({
  windowMs: 15 * 60_000,   // 15 min
  limit: 100,              // per IP per window
  standardHeaders: "draft-7",  // RateLimit-* headers (RFC 9239)
  legacyHeaders: false
});
app.use(limiter);

const tierLimits = { free: 60, pro: 600, enterprise: 6000 };
const dynamicLimiter = rateLimit({
  windowMs: 60_000,
  limit: (req) => tierLimits[req.user?.plan || "free"]
});

rateLimit({
  windowMs: 60_000, limit: 30,
  message: { error: { code: "RATE_LIMITED", message: "Slow down — try again in a minute." } }
});

rateLimit({
  windowMs: 60_000, limit: 30,
  handler: (req, res, next, options) => {
    res.set("Retry-After", Math.ceil(options.windowMs / 1000));
    res.status(429).json({ error: "Too Many Requests", retryAfter: options.windowMs });
  }
});

const loginLimiter = rateLimit({
  windowMs: 15 * 60_000, limit: 5,
  skipSuccessfulRequests: true,
  keyGenerator: (req) => `${req.ip}:${req.body?.email || ""}`
});
app.post("/login", loginLimiter, loginHandler);

import { RedisStore } from "rate-limit-redis";
import Redis from "ioredis";
const redis = new Redis(process.env.REDIS_URL);

app.use(rateLimit({
  windowMs: 60_000, limit: 1000,
  store: new RedisStore({ sendCommand: (...args) => redis.call(...args) })
}));

import { RateLimiterRedis } from "rate-limiter-flexible";

const limiter = new RateLimiterRedis({
  storeClient: redis, points: 100, duration: 60, blockDuration: 60
});

app.use(async (req, res, next) => {
  try { await limiter.consume(req.ip); next(); }
  catch (rej) {
    res.set("Retry-After", Math.ceil(rej.msBeforeNext / 1000));
    res.status(429).json({ error: "Too Many Requests" });
  }
});

rateLimit({
  windowMs: 60_000, limit: 100,
  skip: (req) => req.path === "/health" || TRUSTED_IPS.has(req.ip)
});