IP-based rate limiting can be bypassed by attackers with many IPs (botnets). For sensitive endpoints, combine IP-based with user-based (after auth) and add CAPTCHA for repeated failures. Rate limiting slows abuse; it does not eliminate it.
Use express-rate-limit. Add a global limiter (100 req per 15 min per IP) and stricter limiters on auth routes (5 per 15 min). Return 429 with a Retry-After header. Use a Redis store for distributed setups so limits work across instances.
429 Too Many Requests. Include a Retry-After header so clients know how long to wait. express-rate-limit sets this automatically when standardHeaders: true.
To prevent brute-force password attacks. A global limit of 100 per 15 min is too loose for login; an attacker can try many passwords. A 5-per-15-min limit on login stops brute force.
Browse all our FAQs or reach out to our support team
Your learning library
Find your next course. Build something great.
