{"id":46019,"library":"ratelimit.js","title":"ratelimit.js","description":"A Node.js rate-limiting library using sliding windows stored in Redis. Version 1.8.0 (latest as of 2025) is stable with infrequent updates. It supports multiple rules per instance, whitelisting/blacklisting, and includes Express middleware. Compared to alternatives like express-rate-limit, it relies on Redis for distributed rate limiting and uses a sliding window algorithm for more accurate throttling.","status":"active","version":"1.8.0","language":"javascript","source_language":"en","source_url":"https://github.com/dudleycarr/ratelimit.js","tags":["javascript","rate limit","rate limiting","throttle","express rate limiting","redis","redis rate limiting"],"install":[{"cmd":"npm install ratelimit.js","lang":"bash","label":"npm"},{"cmd":"yarn add ratelimit.js","lang":"bash","label":"yarn"},{"cmd":"pnpm add ratelimit.js","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"Required for connecting to Redis to store rate limit state.","package":"redis","optional":false}],"imports":[{"note":"CommonJS only; ESM is not supported. The package exports RateLimit and ExpressMiddleware as named exports.","wrong":"const RateLimit = require('ratelimit.js');","symbol":"RateLimit","correct":"const { RateLimit } = require('ratelimit.js');"},{"note":"Named export; accessing via property on default export works but standard is destructuring.","wrong":"const ExpressMiddleware = require('ratelimit.js').ExpressMiddleware;","symbol":"ExpressMiddleware","correct":"const { ExpressMiddleware } = require('ratelimit.js');"},{"note":"When using ioredis with key prefixing, set clientPrefix: true and pass the ioRedisClient.keyPrefix as prefix to avoid double prefixing.","wrong":"new RateLimit(ioRedisClient, rules, { prefix: 'myPrefix' });","symbol":"RateLimit with ioredis","correct":"const RateLimit = require('ratelimit.js').RateLimit;\nconst limiter = new RateLimit(ioRedisClient, rules, { prefix: ioRedisClient.keyPrefix, clientPrefix: true });"}],"quickstart":{"code":"const redis = require('redis');\nconst { RateLimit } = require('ratelimit.js');\n\nconst client = redis.createClient({ url: process.env.REDIS_URL ?? 'redis://localhost:6379' });\nconst rules = [\n  { interval: 1, limit: 5 },\n  { interval: 3600, limit: 1000, precision: 100 }\n];\nconst limiter = new RateLimit(client, rules);\n\nconst key = 'user:123';\nlimiter.incr(key, (err, isRateLimited) => {\n  if (err) return console.error(err);\n  console.log('Is rate limited?', isRateLimited);\n});","lang":"javascript","description":"Demonstrates creating a RateLimit instance with two rules (per-second and per-hour) and checking if a key is rate limited."},"warnings":[{"fix":"Use precision defaults (interval in seconds) or set precision to a lower value (e.g., precision: 100 for 100ms slots).","message":"The precision option in rules can significantly increase Redis memory usage. High precision leads to more keys per interval.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Use unwhitelist() or unblacklist() to remove entries, or implement TTL via external key expiration.","message":"Whitelist/blacklist keys are stored indefinitely; they must be explicitly removed or they will persist across application restarts.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Wrap incr() calls with error handling and consider implementing a circuit breaker.","message":"The library does not handle Redis connection errors gracefully; if Redis is down, incr() calls will return errors that must be handled.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Migrate to 1.x by using new RateLimit(client, rules) and calling limiter.incr(key, callback).","message":"Version 0.x used a different API (e.g., RateLimit.create). Upgrade path requires rewriting code to use constructor and incr().","severity":"breaking","affected_versions":"<1.0.0"}],"env_vars":null,"search_vec":"'1.8.0':15 '2025':19 'accur':60 'algorithm':57 'altern':38 'compar':36 'distribut':49 'express':34,41,68 'express-rate-limit':40 'includ':33 'infrequ':23 'instanc':30 'javascript':62 'latest':16 'librari':7 'like':39 'limit':6,43,51,64,66,70,74 'middlewar':35 'multipl':27 'node.js':3 'per':29 'rate':5,42,50,63,65,69,73 'rate-limit':4 'ratelimit.js':1 'redi':13,47,71,72 'reli':45 'rule':28 'slide':9,55 'stabl':21 'store':11 'support':26 'throttl':61,67 'updat':24 'use':8,53 'version':14 'whitelisting/blacklisting':31 'window':10,56","created_at":"2026-06-07T12:57:53.016880+00:00","updated_at":"2026-06-07T12:57:53.016880+00:00","problems":[{"fix":"Use const { RateLimit } = require('ratelimit.js'); then new RateLimit(...)","cause":"Importing the package incorrectly; returns an object with named exports.","error":"TypeError: RateLimit is not a constructor"},{"fix":"Ensure Redis is running on localhost:6379 or set REDIS_URL environment variable properly.","cause":"Redis server is not running or URL is incorrect.","error":"Error: Redis connection failed - connect ECONNREFUSED"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"http://ratelimit.io","github":"https://github.com/dudleycarr/ratelimit.js","docs":null,"changelog":null,"pypi":null,"npm":"ratelimit.js","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security","devops"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}