Sliding-Window Rate Limiting for Express Routes Backed by Redis

import { readFileSync } from 'fs';
import { join } from 'path';
import type { Redis } from 'ioredis';

export interface LimiterOptions {
  limit: number;
  windowMs: number;
  prefix?: string;
}

export interface LimitResult {
  allowed: boolean;
  remaining: number;
  retryAfter: number;
  limit: number;
}

export class RedisRateLimiter {
  private readonly script = readFileSync(join(__dirname, 'slidingWindow.lua'), 'utf8');
  private sha: string | null = null;

  constructor(private readonly redis: Redis, private readonly opts: LimiterOptions) {}

  async check(identifier: string): Promise<LimitResult> {
    const { limit, windowMs, prefix = 'rl' } = this.opts;
    const now = Date.now();
    const windowIndex = Math.floor(now / windowMs);
    const elapsed = now - windowIndex * windowMs;

    const currKey = `${prefix}:${identifier}:${windowIndex}`;
    const prevKey = `${prefix}:${identifier}:${windowIndex - 1}`;

    const [allowed, remaining, retryAfter] = await this.eval(
      [currKey, prevKey],
      [limit, windowMs, elapsed]
    );

    return { allowed: allowed === 1, remaining, retryAfter, limit };
  }

  private async eval(keys: string[], args: number[]): Promise<[number, number, number]> {
    try {
      if (!this.sha) this.sha = await this.redis.script('LOAD', this.script) as string;
      return await this.redis.evalsha(this.sha, keys.length, ...keys, ...args) as [number, number, number];
    } catch (err: any) {
      if (String(err?.message).includes('NOSCRIPT')) {
        this.sha = null;
        return await this.redis.eval(this.script, keys.length, ...keys, ...args) as [number, number, number];
      }
      throw err;
    }
  }
}

import type { Request, Response, NextFunction, RequestHandler } from 'express';
import type { RedisRateLimiter } from './RedisRateLimiter';

type KeyFn = (req: Request) => string;

export function rateLimit(limiter: RedisRateLimiter, keyFn: KeyFn): RequestHandler {
  return async (req: Request, res: Response, next: NextFunction) => {
    const identifier = keyFn(req);

    try {
      const result = await limiter.check(identifier);

      res.setHeader('X-RateLimit-Limit', result.limit);
      res.setHeader('X-RateLimit-Remaining', result.remaining);

      if (!result.allowed) {
        res.setHeader('Retry-After', result.retryAfter);
        return res.status(429).json({
          error: 'rate_limited',
          message: `Too many requests. Retry after ${result.retryAfter}s.`,
        });
      }

      return next();
    } catch (err) {
      // Fail open: never let a Redis outage take down the route.
      req.app.locals.logger?.error({ err, identifier }, 'rate limiter error');
      return next();
    }
  };
}

export const ipKey: KeyFn = (req) =>
  `ip:${req.ip ?? req.socket.remoteAddress ?? 'unknown'}`;

export const apiKey: KeyFn = (req) =>
  `key:${(req.header('x-api-key') ?? 'anonymous').slice(0, 64)}`;

import { Router } from 'express';
import Redis from 'ioredis';
import { RedisRateLimiter } from './RedisRateLimiter';
import { rateLimit, ipKey, apiKey } from './rateLimit';

const redis = new Redis(process.env.REDIS_URL ?? 'redis://localhost:6379');

const loginLimiter = new RedisRateLimiter(redis, {
  limit: 5,
  windowMs: 60_000,
  prefix: 'rl:login',
});

const searchLimiter = new RedisRateLimiter(redis, {
  limit: 120,
  windowMs: 60_000,
  prefix: 'rl:search',
});

export const router = Router();

router.post('/auth/login', rateLimit(loginLimiter, ipKey), (req, res) => {
  // ...credential verification
  res.json({ ok: true });
});

router.get('/api/search', rateLimit(searchLimiter, apiKey), (req, res) => {
  res.json({ results: [] });
});