express-quick-limiter

Fast, lightweight, zero-dependency sliding-window rate limiting middleware for Express and Node.js applications.

Installation

npm install express-quick-limiter

or with yarn:

yarn add express-quick-limiter

or with pnpm:

pnpm add express-quick-limiter

Quick Start

1. Global Rate Limiter

import express from 'express';
import quickLimiter from 'express-quick-limiter';

const app = express();

// Limit each IP to 100 requests per 15 minutes
const limiter = quickLimiter({
  windowMs: 15 * 60 * 1000,
  max: 100,
  message: {
    status: 429,
    error: 'Too Many Requests',
    message: 'Too many requests from this IP, please try again later.',
  },
});

app.use(limiter);

app.get('/api/data', (req, res) => {
  res.json({ success: true });
});

app.listen(3000);

2. Route-Specific Rate Limiter (e.g. Auth / Login)

Protect brute-force endpoints with stricter limits:

const authLimiter = quickLimiter({
  windowMs: 60 * 1000, // 1 minute
  max: 5, // max 5 login attempts per minute
  message: 'Too many login attempts. Please try again after 1 minute.',
});

app.post('/api/login', authLimiter, (req, res) => {
  // Handle login logic
});

3. Rate Limit by User ID or API Key

const apiLimiter = quickLimiter({
  windowMs: 60 * 1000,
  max: 60,
  keyGenerator: (req) => {
    // Rate limit per API Key or Bearer Token
    return req.headers['x-api-key'] || req.ip;
  },
});

app.use('/api', apiLimiter);

4. Skip Whitelisted Endpoints

const limiter = quickLimiter({
  windowMs: 15 * 60 * 1000,
  max: 100,
  skip: (req) => {
    // Skip healthcheck routes or internal services
    return req.path === '/health' || req.ip === '127.0.0.1';
  },
});

5. Programmatic Key Reset

// Reset a user's rate limit upon successful verification / admin action
limiter.resetKey('192.168.1.1');

Response Headers

When rate limiting is active, express-quick-limiter automatically attaches the standard HTTP rate limit headers:

• RateLimit-Limit: Maximum allowed requests within the window
• RateLimit-Remaining: Number of remaining allowed requests
• RateLimit-Reset: Time remaining until window reset (seconds)
• Retry-After: Seconds until the client can retry (when rate-limited)
• X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset

Configuration Options

| Option | Type | Default | Description | | :--- | :--- | :--- | :--- | | windowMs | number | 900000 (15m) | Time frame window in milliseconds | | max | number \| (req) => number | 100 | Max requests allowed within windowMs | | statusCode | number | 429 | HTTP status code returned when limit exceeded | | message | string \| object \| (req, res) => any | Standard JSON | Response sent when limit is reached | | keyGenerator | (req) => string | Client IP | Function to extract unique client key | | skip | (req, res) => boolean | undefined | Function to skip rate limiting for requests | | headers | boolean | true | Send standard rate limit headers | | skipSuccessfulRequests | boolean | false | Don't count requests with status < 400 | | skipFailedRequests | boolean | false | Don't count requests with status >= 400 | | store | Store | MemoryStore | Custom storage mechanism |

License

MIT