Enabling rate limit on all routes

[GreenFlag31]

Hey !
First of all, thank for this librairy. I have a question about the following :

When the user makes a GET request to a valid endpoint (I'm building an API) in my code too many times, the limit is successfully triggered. But when the endpoint is not valid, for exemple :
https://myURL/api/endpoint/invalid-endpoint
I return an error message to the user in JSON that the endpoint is not correct, but the rate limit is not triggered, since I already return an 404 code.

How to enable it everywhere ? I mean, when a single request is made to an invalid endpoint, I still want to return my error message, but if it's repetitive calls, I want to limit the queries.

thank you in advance

[nfriedly]

Normally it depends on what order things are defined in, although, I'm not sure in the case of an error handler. Did you set up the error handler before the rate limiter? If so, try switching them. If not, or if that doesn't work, could you post a snippet of your code?

[GreenFlag31]

Thank for you answer.
Yes, I define my query limit before defining my different routes :

import express from 'express';
import { queryLimit } from '../middleware/limit.js';   // the file where I define my limiter

const coffeeRouter = express.Router();
coffeeRouter.use(queryLimit);

// routes definition, for exemple : 
coffeeRouter.get('/type/:type', async (req, res) => {
  try {
    req.params.type = req.params.type?.trim().toLowerCase();
    if (req.params.type !== undefined && coffeeTypes.indexOf(req.params.type) === -1) {
      throw Error('Invalid type');
    }
// ...
error handling : 
res.status(404).json({ error: error.message })

If you need other info, don't hesitate.

Cheers

[gamemaker1]

Is that error handling line within a piece of middleware registered with the main express app, or just the coffee router?

[gamemaker1]

Here's an example that works for me (I tested it rn) -

// source/app.js
// Creates and starts the server.

import express from 'express'
import rateLimit from 'express-rate-limit'
import { consola } from 'consola'

// Create the server, and a route.
const server = express()
const router = express.Router()

// Register the rate limiter before anything else.
const limiter = rateLimit({
  windowMs: 60 * 1000, // 1 min
  max: 2, // 2 req per minute
  standardHeaders: true,
  legacyHeaders: false,
  message: {
    error: 'Rate limit reached; please try making this request after sometime!'
  },
  handler: (request, response, next, options) => {
    consola.info('client was rate limited', request.rateLimit)
    response.status(options.statusCode).send(options.message)
  }
})
router.use(limiter)

// Then add an endpoint, for fun.
router.get('/water', async (request, response) => {
  consola.info('client requested water')
  response.status(200).send({ beverage: 'water' })
})

// Pinging any other endpoint will return a 404.
router.all('*', async (request, response) => {
  consola.info('client pinged non existent endpoint')
  response.status(400).send({
    error: 'This endpoint does not exist. Please make a GET request to the /docs endpoint for a list of valid endpoints.'
  })
})

// Register this route with the server.
server.use('/api', router)

// Start the server on port 4040.
server.listen(4040, () => consola.start('listening on 4040'))

[GreenFlag31]

Thanks for you feedback, I've tested your code, it works indeed.
I think because of this part :

  handler: (request, response, next, options) => {
    consola.info('client was rate limited', request.rateLimit);
    response.status(options.statusCode).send(options.message);
  },

In between, I'm rather opting for a server cache, I think this is a preferable option.

I used the simple provided example from the documentation (without handler) :

const limiter = rateLimit({
	windowMs: 15 * 60 * 1000, // 15 minutes
	max: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
	standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
	legacyHeaders: false, // Disable the `X-RateLimit-*` headers
})