How to implement rate limiting in Express.js

Short answer

Use express-rate-limit middleware to cap requests per IP within a time window. For distributed systems, swap the default memory store for a Redis store so all server instances share the same counters.

Details

Rate limiting prevents brute-force attacks and accidental client overload. A typical setup configures windowMs (the time window) and max (allowed requests per window). You can customize the handler for exceeded limits to return 429 Too Many Requests with a Retry-After header.

In production, an in-memory store fails when running multiple Node.js processes or containers. Use rate-limit-redis to centralize state. If you are deploying with containers, see How to use Docker Compose to spin up Redis alongside your app. For load-balancing across instances, also explore what is Node.js cluster module and how to use it.

Tips

• Skip rate limiting for health check endpoints to avoid false alarms from load balancers.
• Use a keyed limiter based on user ID rather than IP when users may share a NAT.
• For secure header handling, review how to handle errors with try-catch in your limiter callbacks.