animir/node-rate-limiter-flexible/rate-limiter-flexible

rate-limiter-flexible

Harden application security against brute-force and DoS attacks. Atomic and non-atomic counters and rate limiting tools for Node.js, Deno, and browsers (Memory limiter). Zero production dependencies. Enhanced fixed window algorithm. ISC license.

• Install: npm i rate-limiter-flexible
• ESM: import { RateLimiterMemory } from "rate-limiter-flexible"
• CommonJS: const { RateLimiterMemory } = require("rate-limiter-flexible")

When to Use This Skill

• Configuring any rate-limiter-flexible limiter (options, API, store setup)
• Writing Express/Koa/Hapi rate limiting middleware
• Implementing login brute-force protection or DoS mitigation
• Choosing between store backends (Redis vs Memory vs Mongo vs etc.)
• Setting up insurance strategy, in-memory block strategy, or BurstyRateLimiter
• Understanding RateLimiterRes object and HTTP response headers

Quick Reference

See references/full-reference.md for the complete guide covering:

• All options (common + store-specific) with defaults
• All API methods (consume, get, set, block, delete, penalty, reward, deleteInMemoryBlockedAll)
• RateLimiterMemory best-effort persistence via dump() / restore() (snapshot state for graceful restarts)
• All 15+ limiter types (Redis, Memory, Mongo, MySQL, PostgreSQL, DynamoDB, Memcached, Prisma, Drizzle, SQLite, Etcd, Valkey, Cluster, PM2)
• Composite limiters (BurstyRateLimiter, RateLimiterUnion, RateLimiterQueue)
• Wrappers (Black/White lists, Timeouts, AWS SDK v3)
• Code examples for every common pattern

Essential Patterns at a Glance

Basic Usage

const { RateLimiterMemory } = require("rate-limiter-flexible");
const limiter = new RateLimiterMemory({
  points: 10,   // 10 requests
  duration: 1,  // per second
});
limiter.consume(req.ip)
  .then((res) => { /* allowed */ })
  .catch((res) => {
    if (res instanceof Error) { /* store error */ }
    else { /* rate limited — res is RateLimiterRes */ }
  });

HTTP Response Headers

const headers = {
  "Retry-After": rateLimiterRes.msBeforeNext / 1000,
  "X-RateLimit-Limit": opts.points,
  "X-RateLimit-Remaining": rateLimiterRes.remainingPoints,
  "X-RateLimit-Reset": Math.ceil((Date.now() + rateLimiterRes.msBeforeNext) / 1000)
};

Key Defaults

Links

• Full Wiki
• Options
• API Methods
• Usage Examples