Implement Rate Limiting in Node.js with Express-Rate-Limit

Every developer wants their application to be popular. But such high traffic could crash your server if not prepared for it. So, you need some method that will help you control the incoming requests. Rate Limiting in Node.js acts like a traffic cop for your API. It protects legitimate users with a fast experience, but stops bots and abusive scripts from overloading your resources.

Why Rate Limiting is Important

Think of it like this: You’re running a ticket counter for some popular movie. One guy tries to buy 1,000 tickets at once. Everybody else is stuck waiting in line forever. Your API does the same thing. Without limits, one malicious user or a buggy script uses up all of the processing power on your server.

Rate limiting solves this by defining the number of requests a user can make within a specific timeframe. It is useful in controlling the number of API requests that Node.js servers process. This will effectively prevent DoS attacks by bad actors who try to overpower your system. It saves money on bandwidth and infrastructure costs by rejecting unnecessary traffic at an early stage.

Getting Started with Express-Rate-Limit

You don’t have to implement complex algorithms to handle request counting. There’s a great open source package called express-rate-limit. It acts as an Express rate limiter middleware that you can drop into your application with minimum effort.

First, open your terminal and navigate to your project folder. Install the package using NPM:

npm install express-rate-limit

Adding Basic Rate Limiting in Express Application

Let’s set up a basic limiter that applies to all requests in your Node.js application. We will create a rule that allows a user to make 100 requests every 15 minutes. This setup covers general API protection.

Here is sample code to implement this type of rate limiting in express.

const express = require('express');
const rateLimit = require('express-rate-limit');

const app = express();

const limiter = rateLimit({
    windowMs: 15 * 60 * 1000,
    limit: 100,
    standardHeaders: true,
    legacyHeaders: false
});

app.use(limiter);

app.get('/', (req, res) => {
    res.send('Hello World');
});

app.listen(3000);

As per above configuration of rate limiting, windowMs defines the time frame in milliseconds. The limit represents the maximum number of connections allowed per IP during that window. Once a user hits that limit, the middleware automatically sends an error response.

Advanced Rate Limit Configuration for Specific Routes in Node.Js

Sometimes you need stricter rules for specific routes. Login endpoints often attract hackers trying to guess passwords. You can create a specialized limiter to prevent brute force attack Node.js vulnerabilities. This approach also be useful when you want to define rate limit with each group of services.

Let’s take another example where we will configure this limiter to provide a custom error message and a specific status code. This tells the client exactly what happened. We also disable legacy headers to keep the response clean and backward compatible.

const loginLimiter = rateLimit({
    windowMs: 60 * 60 * 1000,
    limit: 5,
    message: {
        status: 429,
        error: 'Too many login attempts from this IP, please try again after an hour'
    },
    statusCode: 429,
    standardHeaders: true,
    legacyHeaders: false
});

app.post('/login', loginLimiter, (req, res) => {
    res.send('Login successful');
});

This configuration restricts an IP address to only 5 login attempts per hour. If they exceed this, they receive a 429 “Too Many Requests” status. This targeted approach significantly improves security without punishing normal users browsing other parts of your site.

Conclusion

Securing your API is a need of the hour in modern web development. This express-rate-limit npm tutorial demonstrated how easily you can add protection to your application. Now, you can control the flow of traffic and prevent sensitive routes from being abused. By implementing Rate Limiting in Node.js, you ensure that your application remains stable, reliable, and fast for everyone.

Codewolfy