rate-limiter-flexible

rate-limiter-flexible is a Node.js library for counting and limiting the number of events per key (IP address, user ID, API route, etc.), protecting applications from denial-of-service and brute-force attacks. It provides a unified API across a wide range of backing stores — Redis, Valkey, Memcached, MongoDB, MySQL, PostgreSQL, SQLite, DynamoDB, Prisma, Drizzle, etcd, in-process Memory, and Cluster/PM2 — so applications can start with an in-memory limiter and move to a distributed store without rewriting call sites.

Beyond basic point-consumption rate limiting, the library offers advanced composition primitives: RateLimiterUnion to combine multiple limiters as one, BurstyRateLimiter for traffic bursts, RateLimiterQueue for FIFO-ordered request queuing, block-and-insurance strategies for resilience when a backing store is unavailable, and black/white-list wrappers. It has no production dependencies in its core, ships bundled TypeScript declarations, and is used widely to protect login endpoints, APIs, and WebSocket connections from abuse.

What You Get

• A unified consume/get/set/block/penalty/reward API that works identically across a dozen supported backing stores
• Backends for Redis, Valkey, Memcached, MongoDB, MySQL, PostgreSQL, SQLite, DynamoDB, Prisma, Drizzle, etcd, in-process Memory, and Cluster/PM2
• Composable strategies: RateLimiterUnion (combine limiters), BurstyRateLimiter (traffic bursts), RateLimiterQueue (FIFO queuing)
• Resilience features: in-memory block strategy to reduce store round-trips, and an insurance limiter as a fallback if the primary store is down
• Zero production dependencies in the core package, with bundled TypeScript type declarations
• Documented middleware patterns for Express, Koa, and Hapi, plus community packages for GraphQL and NestJS

Common Use Cases

• Protecting login and authentication endpoints from brute-force password-guessing attacks
• Rate-limiting a public API per user or API key, with different limits for authorized vs. unauthorized traffic
• Preventing WebSocket connection flooding by limiting connection attempts per client
• Throttling third-party API calls or crawler/bot traffic to stay within upstream rate limits

Under The Hood

Architecture - The library is built around an abstract base (RateLimiterAbstract.js) that defines the shared point-consumption contract, with RateLimiterStoreAbstract.js extending it for store-backed limiters and each backend (Redis, Mongo, MySQL, Postgres, DynamoDB, Prisma, Drizzle, etcd, Memcache, Valkey, ValkeyGlide) implementing that contract as its own module under lib/; composition classes (RateLimiterUnion, BurstyRateLimiter, RateLimiterQueue, RLWrapperBlackAndWhite, RLWrapperTimeouts) wrap one or more limiter instances to add higher-level behavior without touching the store implementations. Tech Stack - Pure JavaScript with zero required production dependencies in the core; each store backend is an optional peer integration (works with ioredis/redis, @valkey/valkey-glide/iovalkey, mongodb/mongoose, mysql/mysql2, pg, sequelize/typeorm/knex, prisma, drizzle-orm, memcached), so consumers only pull in the client library for the store they use. Code Quality - The project has an extensive test/ suite with a dedicated test file per backend (e.g. RateLimiterRedis.test.js, RateLimiterMySQL.test.js, RateLimiterDynamo.test.js) plus component-level tests, reflecting the discipline needed to keep atomic-increment correctness across a dozen very different storage engines; 60 contributors and continuous releases (67 tagged versions) indicate sustained maintenance. API Design - Every limiter exposes the same consume(key, points) promise-based method regardless of backing store, so switching from RateLimiterMemory to RateLimiterRedis in production requires changing only the constructor call; the RateLimiterRes result object bundles msBeforeNext, remainingPoints, and consumedPoints in a form that maps directly onto standard rate-limit HTTP headers.