Securing APIs: Express Rate Limit and Slow Down

Protect your Express.js APIs from brute force attacks, resource exhaustion, and abuse with production-ready rate limiting strategies.

Rate limiting is one of the most critical security measures you can implement for any Express API. Without proper rate limiting, your application is vulnerable to brute force attacks, denial of service attempts, and resource exhaustion from aggressive clients. This guide covers how to implement robust rate limiting using the most popular and well-maintained middleware packages.

What you'll learn:

  • Installing and configuring express-rate-limit middleware
  • Creating specialized rate limiters for different endpoint types
  • Implementing slow-down mechanisms for graduated response
  • Production best practices including Redis-backed storage
  • Common pitfalls and troubleshooting techniques

10M+

Weekly downloads for express-rate-limit

15min

Typical rate limit window

429

HTTP status for rate limited requests

Why Rate Limiting Matters for Express APIs

Rate limiting controls how many requests a client can make within a specified time window. This simple mechanism provides powerful protection against several categories of threats.

The Security Imperative

Modern APIs face constant pressure from automated clients, misbehaving scripts, and malicious actors. A single client making hundreds of requests per second can exhaust your server resources, degrade performance for legitimate users, and potentially crash your application entirely. Rate limiting acts as a first line of defense that keeps your API responsive even under attack.

According to the OWASP API Security Top 10, lack of proper rate limiting is a critical vulnerability that affects API security posture and availability.

Rate limiting protects against:

  • Brute force attacks on authentication endpoints
  • Web scrapers consuming excessive bandwidth
  • Accidental or intentional request storms
  • Resource exhaustion from aggressive clients

Installing and Configuring express-rate-limit

The express-rate-limit package is the standard solution for rate limiting in Express applications. With over 10 million weekly downloads and active maintenance, it provides a reliable foundation for protecting your APIs. This middleware is widely used in production Node.js applications for security and stability. Understanding classes in JavaScript and modern TypeScript patterns from our guide on best TypeScript ORMs complements these security implementations for building robust, type-safe APIs.

Key configuration options:

  • windowMs: Time window for tracking requests (15 minutes = 900000ms)
  • max: Maximum requests allowed per window
  • message: Customizable error response
  • standardHeaders: Return rate limit info in RateLimit-* headers
  • keyGenerator: Custom function to identify clients
Install express-rate-limit
npm install express-rate-limit
# or
yarn add express-rate-limit
# or
pnpm add express-rate-limit
Basic rate limiter configuration
1import express from 'express';2import rateLimit from 'express-rate-limit';3 4const app = express();5 6const limiter = rateLimit({7 windowMs: 15 * 60 * 1000, // 15 minutes8 max: 100, // Limit each IP to 100 requests per windowMs9 message: {10 error: 'Too many requests, please try again later.'11 },12 standardHeaders: true, // Return rate limit info in RateLimit-* headers13 legacyHeaders: false, // Disable X-RateLimit-* headers14});15 16app.use(limiter);

Creating Specialized Rate Limiters

Not all API endpoints deserve the same treatment. Authentication endpoints need stricter limits than public data endpoints. Create multiple limiters for nuanced protection.

Stricter Limits for Authentication

Authentication endpoints are prime targets for brute force attacks. The Better Stack guide on rate limiting recommends significantly lower limits for authentication endpoints to prevent credential stuffing attacks. For comprehensive authentication systems, combining rate limiting with proper TypeScript type guards ensures both security and type safety throughout your application.

Authentication endpoint rate limiting
1const authLimiter = rateLimit({2 windowMs: 15 * 60 * 1000,3 max: 5, // Only 5 login attempts per 15 minutes4 message: {5 error: 'Too many login attempts. Please try again after 15 minutes.'6 },7 skipSuccessfulRequests: true, // Don't count successful logins8});9 10const passwordResetLimiter = rateLimit({11 windowMs: 60 * 60 * 1000,12 max: 3, // Only 3 password reset requests per hour13 message: {14 error: 'Password reset limit exceeded. Please try again in an hour.'15 },16});17 18app.post('/api/auth/login', authLimiter, loginHandler);19app.post('/api/auth/password-reset', passwordResetLimiter, passwordResetHandler);

Tiered Rate Limiting by User Plan

For APIs offering different service tiers, rate limits should match the user's plan. This approach lets you offer different service levels while maintaining consistent protection across all users. Combined with TypeScript type guards for runtime validation, you can build robust, type-safe APIs that handle all edge cases gracefully.

Tiered rate limiting by user plan
1const tiers = {2 free: { windowMs: 60 * 60 * 1000, max: 100 },3 pro: { windowMs: 60 * 60 * 1000, max: 1000 },4 enterprise: { windowMs: 60 * 60 * 1000, max: 10000 },5};6 7const tierLimiter = rateLimit({8 windowMs: 60 * 60 * 1000,9 max: (req) => tiers[req.user?.tier]?.max || tiers.free.max,10 keyGenerator: (req) => req.user?.id || req.ip,11});

Implementing Slow-Down Mechanisms

Rate limiting works well for hard limits, but sometimes a graduated response is more appropriate. The express-slow-down middleware adds increasing delays rather than rejecting requests outright.

When to use slow-down:

  • Search endpoints that consume significant resources
  • Third-party data integration that shouldn't break entirely
  • Traffic smoothing during peak periods
Express slow-down middleware
1import slowDown from 'express-slow-down';2 3const speedLimiter = slowDown({4 windowMs: 15 * 60 * 1000,5 delayAfter: 50, // Allow first 50 requests with no delay6 delayMs: (hits) => hits * 50, // Add 50ms delay per hit after delayAfter7 maxDelayMs: 2000, // Maximum delay of 2 seconds8});

Combining Rate Limiting with Slow-Down

For comprehensive protection, apply slow-down first, then rate limiting as a backstop. This layered approach lets aggressive clients continue with degraded performance while still preventing resource exhaustion.

Combining both approaches
1app.use(speedLimiter); // Apply slow-down first2app.use(limiter); // Then apply hard rate limit3 4// Order matters: slow-down adds delays, limiter blocks excess

Production Best Practices

Redis-Backed Storage for Distributed Systems

When your Express application runs across multiple instances, in-memory rate limiting doesn't work correctly. Each instance maintains its own request count, so a client could make requests to different instances and bypass your limits entirely. The Better Stack guide on distributed rate limiting recommends Redis-backed storage for production deployments.

Redis provides shared storage for rate limiting state across all application instances. This pattern is essential for scalable mobile backends that serve both web and mobile clients consistently. When building Node.js CLI tools with rate limiting requirements, our guide on building TypeScript CLI applications demonstrates how to implement similar patterns for command-line environments.

Redis-backed rate limiting
1import Redis from 'ioredis';2import RedisStore from 'rate-limit-redis';3 4const redisClient = new Redis({5 host: process.env.REDIS_HOST || 'localhost',6 port: process.env.REDIS_PORT || 6379,7});8 9const limiter = rateLimit({10 windowMs: 15 * 60 * 1000,11 max: 100,12 store: new RedisStore({13 sendCommand: (...args) => redisClient.call(...args),14 prefix: 'rl:',15 }),16});

Customizing Error Responses

Provide informative error responses that help clients understand what happened and what to do next. Include retry information so clients can back off appropriately.

Custom rate limit response
1const limiter = rateLimit({2 windowMs: 15 * 60 * 1000,3 max: 100,4 message: (req, res, options) => {5 const retryAfter = Math.ceil(options.windowMs / 1000);6 return {7 error: 'Too Many Requests',8 message: 'Rate limit exceeded. Please slow down.',9 retryAfter: retryAfter,10 limit: options.max,11 windowSeconds: options.windowMs / 1000,12 };13 },14});
Key Rate Limiting Concepts

Window Configuration

Set time windows from 1 minute to 24 hours based on your API's usage patterns and tolerance for abuse.

Request Limits

Configure max requests per window, with different limits per endpoint type--stricter for auth, generous for reads.

Client Identification

Identify clients by IP, user ID, or API key for targeted rate limiting that doesn't penalize shared networks.

Response Handling

Return informative 429 responses with retry-after headers so clients know when to back off gracefully.

Frequently Asked Questions

Conclusion

Rate limiting and slow-down mechanisms are essential security measures for any Express API. The express-rate-limit package provides a battle-tested foundation with over 10 million weekly downloads, while express-slow-down adds graduated response capabilities.

Key takeaways:

  1. Start with basic rate limiting on all endpoints to establish a security baseline
  2. Add specialized limiters for sensitive operations like authentication with stricter thresholds
  3. Consider Redis-backed storage for production multi-instance deployments to ensure consistency
  4. Monitor rate limit data to detect attacks early and adjust limits based on real usage patterns
  5. Combine slow-down with hard limits for comprehensive protection that balances security and usability

The investment in proper rate limiting pays dividends in system reliability, security posture, and user experience. Your API stays responsive even under attack, legitimate users get fair access to resources, and you gain visibility into how your API is being used.

For more on building secure, performant web applications, explore our web development services and learn how we implement production-ready protections for APIs of all sizes.

Secure Your APIs with Professional Development

Our web development team builds secure, performant APIs with production-ready protections including rate limiting, authentication, and monitoring.

Sources

  1. MDN Web Docs: Securing APIs - Express rate limit and slow down - Comprehensive guide with practical implementation examples
  2. Better Stack: Rate Limiting in Express.js - Production-focused guide covering distributed rate limiting and best practices
  3. NPM: express-rate-limit - Official package documentation with full configuration options
  4. NPM: express-slow-down - Complementary middleware for graduated response delays
  5. OWASP API Security Top 10 - Industry standards for API security best practices