rate-limiter-flexible

What is rate-limiter-flexible?

The rate-limiter-flexible npm package is a powerful and flexible rate limiting library for Node.js. It supports various backends like Redis, MongoDB, and in-memory storage, making it suitable for distributed systems. It helps in controlling the rate of requests to APIs, preventing abuse, and ensuring fair usage.

What are rate-limiter-flexible's main functionalities?

Basic Rate Limiting

This feature allows you to set up basic rate limiting using in-memory storage. The example limits a user to 5 requests per second.

const { RateLimiterMemory } = require('rate-limiter-flexible');

const rateLimiter = new RateLimiterMemory({
  points: 5, // 5 points
  duration: 1, // Per second
});

rateLimiter.consume('user-key')
  .then(() => {
    // Allowed
  })
  .catch(() => {
    // Blocked
  });

Rate Limiting with Redis

This feature demonstrates how to use Redis as a backend for rate limiting. The example limits a user to 10 requests per minute.

const { RateLimiterRedis } = require('rate-limiter-flexible');
const Redis = require('ioredis');

const redisClient = new Redis();
const rateLimiter = new RateLimiterRedis({
  storeClient: redisClient,
  points: 10, // 10 points
  duration: 60, // Per minute
});

rateLimiter.consume('user-key')
  .then(() => {
    // Allowed
  })
  .catch(() => {
    // Blocked
  });

Rate Limiting with MongoDB

This feature shows how to use MongoDB as a backend for rate limiting. The example limits a user to 5 requests per minute.

const { RateLimiterMongo } = require('rate-limiter-flexible');
const mongoose = require('mongoose');

mongoose.connect('mongodb://localhost:27017/rate-limiter', { useNewUrlParser: true, useUnifiedTopology: true });

const rateLimiter = new RateLimiterMongo({
  storeClient: mongoose.connection,
  points: 5, // 5 points
  duration: 60, // Per minute
});

rateLimiter.consume('user-key')
  .then(() => {
    // Allowed
  })
  .catch(() => {
    // Blocked
  });

Rate Limiting with Bursts

This feature allows for burst handling by blocking the user for a specified duration if they exceed the rate limit. The example blocks a user for 10 seconds if they exceed 10 requests per second.

const { RateLimiterMemory } = require('rate-limiter-flexible');

const rateLimiter = new RateLimiterMemory({
  points: 10, // 10 points
  duration: 1, // Per second
  blockDuration: 10, // Block for 10 seconds if consumed more than points
});

rateLimiter.consume('user-key')
  .then(() => {
    // Allowed
  })
  .catch(() => {
    // Blocked
  });

Other packages similar to rate-limiter-flexible

express-rate-limit

express-rate-limit is a basic rate-limiting middleware for Express applications. It is simpler and less flexible compared to rate-limiter-flexible, but it is easier to set up for basic use cases.

rate-limiter

rate-limiter is another rate limiting library for Node.js. It is less feature-rich compared to rate-limiter-flexible and does not support as many backends, but it is straightforward to use for simple rate limiting needs.

bottleneck

bottleneck is a powerful rate limiting and job scheduling library for Node.js. It offers more advanced features like priority queues and job scheduling, making it more suitable for complex use cases compared to rate-limiter-flexible.

README

node-rate-limiter-flexible

rate-limiter-flexible counts and limits number of actions by key and protects from DDoS and brute force attacks at any scale.

It works with Redis, process Memory, Cluster or PM2, Memcached, MongoDB, MySQL, PostgreSQL and allows to control requests rate in single process or distributed environment.

Atomic increments. All operations in memory or distributed environment use atomic increments against race conditions.

Traffic bursts. Replace Token Bucket with BurstyRateLimiter

Fast. Average request takes 0.7ms in Cluster and 2.5ms in Distributed application. See benchmarks.

Flexible. Combine limiters, block key for some duration, delay actions, manage failover with insurance options, configure smart key blocking in memory and many others.

Ready for growth. It provides unified API for all limiters. Whenever your application grows, it is ready. Prepare your limiters in minutes.

Friendly. No matter which node package you prefer: redis or ioredis, sequelize or knex, memcached, native driver or mongoose. It works with all of them.

In memory blocks. Avoid extra requests to store with inmemoryBlockOnConsumed.

Deno compatible See this example

It uses fixed window as it is much faster than rolling window. See comparative benchmarks with other libraries here

Installation

npm i --save rate-limiter-flexible

yarn add rate-limiter-flexible

Basic Example

const opts = {
  points: 6, // 6 points
  duration: 1, // Per second
};

const rateLimiter = new RateLimiterMemory(opts);

rateLimiter.consume(remoteAddress, 2) // consume 2 points
    .then((rateLimiterRes) => {
      // 2 points consumed
    })
    .catch((rateLimiterRes) => {
      // Not enough points to consume
    });

RateLimiterRes object

Both Promise resolve and reject return object of RateLimiterRes class if there is no any error. Object attributes:

RateLimiterRes = {
    msBeforeNext: 250, // Number of milliseconds before next action can be done
    remainingPoints: 0, // Number of remaining points in current duration 
    consumedPoints: 5, // Number of consumed points in current duration 
    isFirstInDuration: false, // action is first in current duration 
}

You may want to set next HTTP headers to response:

const headers = {
  "Retry-After": rateLimiterRes.msBeforeNext / 1000,
  "X-RateLimit-Limit": opts.points,
  "X-RateLimit-Remaining": rateLimiterRes.remainingPoints,
  "X-RateLimit-Reset": new Date(Date.now() + rateLimiterRes.msBeforeNext)
}

Advantages:

• no race conditions
• no production dependencies
• TypeScript declaration bundled
• allow traffic burst with BurstyRateLimiter
• Block Strategy against really powerful DDoS attacks (like 100k requests per sec) Read about it and benchmarking here
• Insurance Strategy as emergency solution if database / store is down Read about Insurance Strategy here
• works in Cluster or PM2 without additional software See RateLimiterCluster benchmark and detailed description here
• useful get, set, block, delete, penalty and reward methods

Middlewares and plugins

• Express middleware
• Koa middleware
• Hapi plugin

Some copy/paste examples on Wiki:

• Minimal protection against password brute-force
• Login endpoint protection
• Websocket connection prevent flooding
• Dynamic block duration
• Authorized users specific limits
• Different limits for different parts of application
• Apply Block Strategy
• Setup Insurance Strategy
• Third-party API, crawler, bot rate limiting

Migration from other packages

• express-brute Bonus: race conditions fixed, prod deps removed
• limiter Bonus: multi-server support, respects queue order, native promises

Docs and Examples

• Options
• API methods
• BurstyRateLimiter Traffic burst support
• RateLimiterRedis
• RateLimiterMemcache
• RateLimiterMongo (with sharding support)
• RateLimiterMySQL (support Sequelize and Knex)
• RateLimiterPostgres (support Sequelize and Knex)
• RateLimiterCluster (PM2 cluster docs read here)
• RateLimiterMemory
• RateLimiterUnion Combine 2 or more limiters to act as single
• RLWrapperBlackAndWhite Black and White lists
• RateLimiterQueue Rate limiter with FIFO queue

Changelog

See releases for detailed changelog.

Basic Options

• points

  Default: 4

  Maximum number of points can be consumed over duration

• duration

  Default: 1

  Number of seconds before consumed points are reset.

  Never reset points, if duration is set to 0.

• storeClient

  Required for store limiters

  Have to be redis, ioredis, memcached, mongodb, pg, mysql2, mysql or any other related pool or connection.

Other options on Wiki:

• keyPrefix Make keys unique among different limiters.
• blockDuration Block for N seconds, if consumed more than points.
• inmemoryBlockOnConsumed Avoid extra requests to store.
• inmemoryBlockDuration
• insuranceLimiter Make it more stable with less efforts.
• storeType Have to be set to knex, if you use it.
• dbName Where to store points.
• tableName Table/collection.
• tableCreated Is table already created in MySQL or PostgreSQL.
• clearExpiredByTimeout For MySQL and PostgreSQL.

Smooth out traffic picks:

• execEvenly
• execEvenlyMinDelayMs

Specific:

• indexKeyPrefix Combined indexes of MongoDB.
• timeoutMs For Cluster.

API

Read detailed description on Wiki.

• consume(key, points = 1) Consume points by key.
• get(key) Get RateLimiterRes or null.
• set(key, points, secDuration) Set points by key.
• block(key, secDuration) Block key for secDuration seconds.
• delete(key) Reset consumed points.
• penalty(key, points = 1) Increase number of consumed points in current duration.
• reward(key, points = 1) Decrease number of consumed points in current duration.
• getKey(key) Get internal prefixed key.

Benchmark

Average latency during test pure NodeJS endpoint in cluster of 4 workers with everything set up on one server.

1000 concurrent clients with maximum 2000 requests per sec during 30 seconds.

1. Memory     0.34 ms
2. Cluster    0.69 ms
3. Redis      2.45 ms
4. Memcached  3.89 ms
5. Mongo      4.75 ms

500 concurrent clients with maximum 1000 req per sec during 30 seconds

6. PostgreSQL 7.48 ms (with connection pool max 100)
7. MySQL     14.59 ms (with connection pool 100)

Note, you can speed up limiters with inmemoryBlockOnConsumed option.

Contribution

Appreciated, feel free!

Make sure you've launched npm run eslint before creating PR, all errors have to be fixed.

You can try to run npm run eslint-fix to fix some issues.

Any new limiter with storage have to be extended from RateLimiterStoreAbstract. It has to implement 4 methods:

• _getRateLimiterRes parses raw data from store to RateLimiterRes object.
• _upsert must be atomic. it inserts or updates value by key and returns raw data. it must support forceExpire mode to overwrite key expiration time.
• _get returns raw data by key or null if there is no key.
• _delete deletes all key related data and returns true on deleted, false if key is not found.

All other methods depends on store. See RateLimiterRedis or RateLimiterPostgres for example.

Note: all changes should be covered by tests.