Introduction

In today's fast-paced digital world, APIs are the backbone of web applications, enabling seamless data exchange. However, APIs are vulnerable to abuse, such as Denial-of-Service (DoS) attacks, excessive bot traffic, and accidental request floods. To combat these challenges, rate limiting is essential. This is where rate-bouncer comes into play! 🎯

rate-bouncer is a lightweight and flexible rate-limiting middleware for Node.js, designed to protect your API from excessive requests while ensuring legitimate users have a smooth experience.

Why Use rate-bouncer? 🤔

✅ Prevents API Abuse: Stops malicious bots and excessive traffic from overwhelming your server.
✅ Customizable: Offers global and per-route configurations, allowing fine-tuned control.
✅ Lightweight & Fast: Minimal footprint with in-memory storage for quick lookups.
✅ Easy Integration: Works effortlessly with Express and similar frameworks.
✅ Automatic Cleanup: Optimizes memory usage by periodically removing old request data.

Getting Started 🚀

Installation

You can install rate-bouncer using npm:

npm install rate-bouncer

Basic Usage

Setting up rate-bouncer in an Express app is straightforward:

const express = require("express");
const { setGlobalRateLimitConfig, rateLimitConfig } = require("rate-bouncer");

const app = express();

// Set global rate limit (applies to all routes unless overridden)
setGlobalRateLimitConfig({
  duration: 15 * 60 * 1000, // 15 minutes
  maxRequests: 100, // Max 100 requests per 15 minutes
  startCleanupInterval: 50000, // Cleanup interval (optional)
});

// Apply rate limiter globally
app.use(rateLimitConfig());

app.get("/api/data", (req, res) => {
  res.send("This route is protected by rate limiting.");
});

app.listen(3000, () => console.log("Server running on port 3000"));

Advanced Configuration ⚙️

Per-Route Customization

Override global settings for specific routes when needed:

app.get(
  "/api/special",
  rateLimitConfig({ duration: 10 * 60 * 1000, maxRequests: 50 }),
  (req, res) => {
    res.send("Limited to 50 requests per 10 minutes.");
  }
);

Disabling Rate Limiting

Need to exclude certain routes? Simply disable rate limiting:

app.get("/api/open", rateLimitConfig({ disabled: true }), (req, res) => {
  res.send("This route has no rate limit.");
});

Handling Exceeded Limits ⚠️

When a user exceeds the allowed request count, they receive a 429 Too Many Requests response:

{
  "message": "Too many requests",
  "retryAfter": "10.0 seconds"
}

Best Practices for Using rate-bouncer 🔥

  • Choose the Right Limits: Set appropriate request limits based on your API's needs.
  • Use Different Limits for Different Routes: Critical routes may need stricter limits than public endpoints.
  • Combine with Authentication: Rate limiting works best when combined with authentication and IP-based restrictions.
  • Monitor Traffic: Regularly check logs to fine-tune rate limits based on real-world usage.

Conclusion 🎯

Rate limiting is a crucial defense against API abuse and traffic overloads. rate-bouncer makes it incredibly easy to implement rate limiting in Node.js applications with minimal setup and maximum flexibility. By integrating this lightweight middleware, you can protect your API, enhance security, and provide a smooth user experience.

Give rate-bouncer a try today! 🚀

👉 Check it out on GitHub: rate-bouncer

Happy coding! 💻🔥