Rate Limiter Middleware
Prerequisites & Dependencies
- Node.js 18+ with Express (or FastAPI, Flask, Go Gin)
npm i express-rate-limit (Token Bucket) or npm i rate-limit-redis (distributed Sliding Window)- Understanding of API throughput requirements and SLA constraints
Execution Steps
- Determine the rate limit: e.g., 100 requests per 15 minutes per IP, or 10 requests per minute per API key
- Choose the algorithm:
- Token Bucket (fixed window, allows burst up to bucket size)
- Sliding Window (counts requests in a moving time window, more precise)
- Install and configure the middleware with
max, windowMs, standardHeaders: true, legacyHeaders: false
- Apply the middleware globally or per-route:
app.use('/api', limiter) or router.get('/strict', limiter, handler)
- Add retry-after header on limit exceed and log exceeded events for SLA monitoring
- Tune limits based on load testing (e.g.,
k6, artillery) and observed traffic patterns
// Express Token Bucket rate limiter
const rateLimit = require('express-rate-limit');
const globalLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15 minutes
max: 100, // limit each IP to 100 requests per windowMs
standardHeaders: true, // Return rate limit info in `RateLimit-*` headers
legacyHeaders: false, // Disable the `X-RateLimit-*` headers
message: 'Too many requests, please try again later.',
});
app.use('/api', globalLimiter);
app.get('/api/data', (req, res) => res.json({ data: 'hello' }));
1---2name: rate-limiter-middleware3description: Build API rate-limiting middleware using Token Bucket or Sliding Window algorithms.4metadata:5 source: skills/rate-limiter-middleware/rate-limiter-middleware.md6---78# Rate Limiter Middleware910## Prerequisites & Dependencies11- Node.js 18+ with Express (or FastAPI, Flask, Go Gin)12- `npm i express-rate-limit` (Token Bucket) or `npm i rate-limit-redis` (distributed Sliding Window)13- Understanding of API throughput requirements and SLA constraints1415## Execution Steps161. Determine the rate limit: e.g., 100 requests per 15 minutes per IP, or 10 requests per minute per API key172. Choose the algorithm: 18 - **Token Bucket** (fixed window, allows burst up to bucket size)19 - **Sliding Window** (counts requests in a moving time window, more precise)203. Install and configure the middleware with `max`, `windowMs`, `standardHeaders: true`, `legacyHeaders: false`214. Apply the middleware globally or per-route: `app.use('/api', limiter)` or `router.get('/strict', limiter, handler)`225. Add retry-after header on limit exceed and log exceeded events for SLA monitoring236. Tune limits based on load testing (e.g., `k6`, `artillery`) and observed traffic patterns2425```javascript26// Express Token Bucket rate limiter27const rateLimit = require('express-rate-limit');2829const globalLimiter = rateLimit({30 windowMs: 15 * 60 * 1000, // 15 minutes31 max: 100, // limit each IP to 100 requests per windowMs32 standardHeaders: true, // Return rate limit info in `RateLimit-*` headers33 legacyHeaders: false, // Disable the `X-RateLimit-*` headers34 message: 'Too many requests, please try again later.',35});3637app.use('/api', globalLimiter);38app.get('/api/data', (req, res) => res.json({ data: 'hello' }));39```
RMAzrim