markdown

📢 This is a fork of express-rate-limit with additional fixes and improvements.

Basic rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.

🔧 Changes in this fork

This fork includes the following improvements over the original package:

• ✅ Fixed ipv6Subnet validation range – Now supports values from 1 to 120 (was limited to 32-64), allowing more flexible IPv6 subnet configurations.
• ✅ Added levenshteinDistance for smart suggestions – When you mistype an option (e.g., windowMS instead of windowMs), the error message now suggests the correct option.
• ✅ Improved knownOptions validation – Uses Levenshtein distance to suggest the closest valid option when an unknown option is provided.
• ✅ Fixed creationStack validation – Removed the conditional localKeys check, so the validation always throws an error when the rate limiter is created inside a request handler (preventing memory leaks).
• ✅ Added windowMs validation in parseOptions – Validates windowMs during configuration parsing for MemoryStore, catching errors earlier.
• ✅ Fixed RateLimit-Reset header in setDraft6Headers – Now the header is only set when the store actually provides a resetTime, as per the draft-6 specification.
• ✅ Exported rawValidations – Allows advanced testing with validations that throw errors directly (without wrapping in try/catch).

Usage

import { rateLimit } from '@bozorgwar/express-rate-limit'

const limiter = rateLimit({
	windowMs: 15 * 60 * 1000, // 15 minutes
	limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes).
	standardHeaders: 'draft-8',
	legacyHeaders: false,
	ipv6Subnet: 56, // Now supports any value between 1 and 120!
})

app.use(limiter)
Installation
bash
npm install @bozorgwar/express-rate-limit
Data Stores
The rate limiter comes with a built-in memory store, and supports a variety of
external data stores.

Configuration
All function options may be async. Click the name for additional info and
default values.

Option	Type	Remarks
[`windowMs`]	number	How long to remember requests for, in milliseconds.
[`limit`]	number | function	How many requests to allow.
[`message`]	string | json | function	Response to return after limit is reached.
[`statusCode`]	number	HTTP status code after limit is reached (default is 429).
[`handler`]	function	Function to run after limit is reached (overrides message and statusCode settings, if set).
[`legacyHeaders`]	boolean	Enable the X-Rate-Limit header.
[`standardHeaders`]	'draft-6' | 'draft-7' | 'draft-8'	Enable the Ratelimit header.
[`identifier`]	string | function	Name associated with the quota policy enforced by this rate limiter.
[`store`]	Store	Use a custom store to share hit counts across multiple nodes.
[`passOnStoreError`]	boolean	Allow (true) or block (false, default) traffic if the store becomes unavailable.
[`keyGenerator`]	function	Identify users (defaults to IP address).
[`ipv6Subnet`]	number (1-120) | function | false	How many bits of IPv6 addresses to use in default keyGenerator (now supports 1-120!)
[`requestPropertyName`]	string	Add rate limit info to the req object.
[`skip`]	function	Return true to bypass the limiter for the given request.
[`skipSuccessfulRequests`]	boolean	Uncount 1xx/2xx/3xx responses.
[`skipFailedRequests`]	boolean	Uncount 4xx/5xx responses.
[`requestWasSuccessful`]	function	Used by skipSuccessfulRequests and skipFailedRequests.
[`validate`]	boolean | object	Enable or disable built-in validation checks.
[`logger`]	Logger	Custom logger
Issues and Contributing
If you encounter a bug or want to see something added/changed, please go ahead
and open an issue!
If you need help with something, feel free to
start a discussion!

Thank You
Thanks to the original authors (Nathan Friedly, Vedant K) for creating this excellent package, and to Mintlify for hosting the documentation at
express-rate-limit.mintlify.app

<p align="center"> <a href="https://mintlify.com/?utm_campaign=devmark&utm_medium=readme&utm_source=express-rate-limit"> <img height="75" src="https://devmark-public-assets.s3.us-west-2.amazonaws.com/sponsorships/mintlify.svg" alt="Create your docs today"> </a> </p>
License
MIT © bozorgwar (this fork)
Original work © Nathan Friedly, Vedant K

[`windowMs`]:
	https://express-rate-limit.mintlify.app/reference/configuration#windowms
[`limit`]: https://express-rate-limit.mintlify.app/reference/configuration#limit
[`message`]:
	https://express-rate-limit.mintlify.app/reference/configuration#message
[`statusCode`]:
	https://express-rate-limit.mintlify.app/reference/configuration#statuscode
[`handler`]:
	https://express-rate-limit.mintlify.app/reference/configuration#handler
[`legacyHeaders`]:
	https://express-rate-limit.mintlify.app/reference/configuration#legacyheaders
[`standardHeaders`]:
	https://express-rate-limit.mintlify.app/reference/configuration#standardheaders
[`identifier`]:
	https://express-rate-limit.mintlify.app/reference/configuration#identifier
[`store`]: https://express-rate-limit.mintlify.app/reference/configuration#store
[`passOnStoreError`]:
	https://express-rate-limit.mintlify.app/reference/configuration#passonstoreerror
[`keyGenerator`]:
	https://express-rate-limit.mintlify.app/reference/configuration#keygenerator
[`ipv6Subnet`]:
	https://express-rate-limit.mintlify.app/reference/configuration#ipv6subnet
[`requestPropertyName`]:
	https://express-rate-limit.mintlify.app/reference/configuration#requestpropertyname
[`skip`]: https://express-rate-limit.mintlify.app/reference/configuration#skip
[`skipSuccessfulRequests`]:
	https://express-rate-limit.mintlify.app/reference/configuration#skipsuccessfulrequests
[`skipFailedRequests`]:
	https://express-rate-limit.mintlify.app/reference/configuration#skipfailedrequests
[`requestWasSuccessful`]:
	https://express-rate-limit.mintlify.app/reference/configuration#requestwassuccessful
[`validate`]:
	https://express-rate-limit.mintlify.app/reference/configuration#validate
[`logger`]:
	https://express-rate-limit.mintlify.app/reference/configuration#logger