How do you implement API rate limiting and brute-force protection using express-rate-limit?
❓ Interview Prompt: Explain rate limiting algorithms, setting up express-rate-limit for login endpoints, and storing hit counts in Redis for clustered servers.
Rate limiting protects APIs against Denial of Service (DoS) attacks, brute-force credential stuffing, and abusive web scraping by restricting the number of requests a client IP can make within a time window.
Using 'express-rate-limit':
In a single-server setup, 'express-rate-limit' stores request timestamps and hit counts in memory. You should apply general rate limits to all routes, and aggressive rate limits to sensitive endpoints like '/login'.
Enterprise Clustered Servers (Redis Store):
In production Kubernetes pods or PM2 clusters, each Node.js process has its own isolated memory. To enforce global rate limits across multiple server instances, connect 'express-rate-limit' to a Redis store ('rate-limit-redis').
Code Implementation Example
import express from 'express';
import rateLimit from 'express-rate-limit';
const app = express();
// 1. General API Rate Limiter
const globalLimiter = rateLimit({
windowMs: 15 * 60 * 1000, // 15-minute time window
max: 100, // Limit each IP to 100 requests per window
standardHeaders: true, // Return RateLimit-* headers
message: { error: 'Too many requests from this IP, try again later.' }
});
// 2. Strict Brute-Force Protection for Login Endpoints
const loginLimiter = rateLimit({
windowMs: 60 * 60 * 1000, // 1 hour window
max: 5, // Maximum 5 login attempts per hour!
message: { error: 'Too many login attempts. Account locked for 1 hour.' }
});
app.use('/api/', globalLimiter);
app.post('/api/auth/login', loginLimiter, (req, res) => { /* Login handler */ });Apply general rate limits globally and strict limits on authentication routes. Use a Redis store for distributed rate limiting across server clusters.