How do you implement rate limiting in Express.js?
Answer
Rate limiting protects your API from abuse, brute force attacks, and DoS. Use the express-rate-limit package: const rateLimit = require('express-rate-limit'); const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }); app.use(limiter); — limits each IP to 100 requests per 15 minutes. For login endpoints, apply a stricter limiter. Combine with express-slow-down to progressively slow responses before outright blocking. For distributed systems where multiple server instances share an IP counter, use a Redis store: express-rate-limit supports pluggable stores. Rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining) inform clients of their quota.
Previous
What is the helmet package and why should you use it?
Next
What is input validation and how do you do it in Express?
More Express.js Questions
View all →- Intermediate How do you implement JWT authentication in Express.js?
- Intermediate What is Express middleware chaining and how does it work?
- Intermediate What is the helmet package and why should you use it?
- Intermediate What is input validation and how do you do it in Express?
- Intermediate How do you connect Express.js to MongoDB using Mongoose?