-
-
Notifications
You must be signed in to change notification settings - Fork 185
API methods
Note, limiter doesn't store any data for key, until you call consume, set, penalty, reward or any other method supposed to change amount of points.
Points can be consumed by IP address, user ID, authorisation token, API route or any other string.
Returns Promise, which:
-
resolved with
RateLimiterReswhen point(s) is consumed, so action can be done -
rejected only for store and database limiters if
insuranceLimiterisn't setup: when some error happened, where reject reasonrejResis Error object -
rejected only for RateLimiterCluster if
insuranceLimiterisn't setup: whentimeoutMsexceeded, where reject reasonrejResis Error object -
rejected when there is no points to be consumed, where reject reason
rejResisRateLimiterResobject -
rejected when key is blocked (if block strategy is set up), where reject reason
rejResisRateLimiterResobject
Alternatively, penalty method can be used to withdraw points. It doesn't throw exceptions when there are not enough points, but resolves with RateLimiterRes instead.
Arguments:
-
keyis usually IP address or some unique string -
pointsinteger number of points consumed.default: 1 -
optionsis object with additional settings:-
customDurationset customdurationfor specifickey.customDurationworks only for new consume calls in the time window. It can not overwrite already existing keys. If limiter's duration is 5 seconds and keyuser1had a call in the beginning of time window withoutcustomDurationthe second consume call won't overwrite it until keyuser1expires in 5 seconds.
-
Get RateLimiterRes in current duration. It always returns RateLimiterRes.isFirstInDuration=false.
Returns Promise, which:
-
resolved with
RateLimiterResif key is set -
resolved with
nullif key is NOT set or expired -
rejected only for database limiters if
insuranceLimiterisn't setup: when some error happened, where reject reasonrejResis Error object -
rejected only for RateLimiterCluster if
insuranceLimiterisn't setup: whentimeoutMsexceeded, where reject reasonrejResis Error object
Arguments:
-
keyis usually IP address or some unique string
Set the integer number of consumed points by key for secDuration seconds.
Store it forever, if secDuration is 0.
Returns Promise, which:
-
resolved with
RateLimiterRes -
rejected only for database limiters if
insuranceLimiterisn't setup: when some error happened, where reject reasonrejResis Error object -
rejected only for RateLimiterCluster if
insuranceLimiterisn't setup: whentimeoutMsexceeded, where reject reasonrejResis Error object
Fine key by points integer number of points for one duration.
Note: Depending on time penalty may go to next durations
Returns Promise, which:
-
resolved with
RateLimiterRes -
rejected only for database limiters if
insuranceLimiterisn't setup: when some error happened, where reject reasonrejResis Error object -
rejected only for RateLimiterCluster if
insuranceLimiterisn't setup: whentimeoutMsexceeded, where reject reasonrejResis Error object
Reward key by points integer number of points for one duration.
Note: Depending on time reward may go to next durations
Returns Promise, which:
-
resolved with
RateLimiterRes -
rejected only for database limiters if
insuranceLimiterisn't setup: when some error happened, where reject reasonrejResis Error object -
rejected only for RateLimiterCluster if
insuranceLimiterisn't setup: whentimeoutMsexceeded, where reject reasonrejResis Error object
Block key by setting consumed points to points + 1 for secDuration seconds.
It force updates expire, if there is already key.
Blocked key never expires, if secDuration is 0. Note, that calling consume function for the blocked key may overwrite the duration. It depends on a particular limiter implementation.
If you need to delete a key blocked forever, use delete function.
Returns Promise, which:
-
resolved with
RateLimiterRes -
rejected only for database limiters if
insuranceLimiterisn't setup: when some error happened, where reject reasonrejResis Error object -
rejected only for RateLimiterCluster if
insuranceLimiterisn't setup: whentimeoutMsexceeded, where reject reasonrejResis Error object
Delete all data related to key.
For example, previously blocked key is not blocked after delete as there is no data anymore.
Returns Promise, which:
-
resolved with
boolean,trueif data is removed by key,falseif there is no such key. -
rejected only for database limiters if
insuranceLimiterisn't setup: when some error happened, where reject reasonrejResis Error object -
rejected only for RateLimiterCluster if
insuranceLimiterisn't setup: whentimeoutMsexceeded, where reject reasonrejResis Error object
Delete all in memory blocked keys. A key may be blocked in memory to avoid extra requests to a store. See in memory block options here
Returns internal key prefixed with keyPrefix option as it is saved in store.
Current duration is the time window between 0 and the number of seconds set with duration option. Every N seconds points are reset to 0.
{
msBeforeNext: 250, // Number of milliseconds before next action can be done
remainingPoints: 0, // Number of remaining points in current duration
consumedPoints: 5, // Number of consumed points in current duration
isFirstInDuration: false, // It is set to true the first time points are consumed after the previous duration reset.
}Get started
Middlewares and plugins
Migration from other packages
Limiters:
- Cluster
- Drizzle
- DynamoDB
- Etcd
- Memcached
- Memory
- MongoDB (with sharding support)
- MySQL
- PM2 Cluster
- PostgreSQL
- Prisma
- Redis
- SQLite
- Valkey: iovalkey and Valkey Glide
- BurstyRateLimiter
- RateLimiterUnion
- RateLimiterQueue
Wrappers:
- AWS SDK v3 Client Rate Limiter
- RLWrapperBlackAndWhite Black and White lists
- RLWrapperTimeouts Timeouts
Knowledge base:
- Block Strategy in memory
- Insurance Strategy
- Periodic sync to reduce number of requests
- Comparative benchmarks
- Smooth out traffic peaks
-
Usage example
- Minimal protection against password brute-force
- Login endpoint protection
- Websocket connection prevent flooding
- Dynamic block duration
- Different limits for authorized users
- Different limits for different parts of application
- Block Strategy in memory
- Insurance Strategy
- Third-party API, crawler, bot rate limiting