كيفية تحديد معدل الطلبات في واجهة Node.js

npm install express-rate-limit

const express = require('express');
const rateLimit = require('express-rate-limit');

const app = express();

const globalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 دقيقة
  max: 200,                  // عدد الطلبات لكل نافذة زمنية لكل IP
  standardHeaders: true,     // إرسال ترويسات RateLimit-*
  legacyHeaders: false,
  message: { error: { code: 'TOO_MANY_REQUESTS', message: 'تمهّل.' } },
});

app.use(globalLimiter);

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  skipSuccessfulRequests: true,
  message: {
    error: {
      code: 'AUTH_RATE_LIMITED',
      message: 'محاولات تسجيل دخول كثيرة جداً. أعد المحاولة بعد 15 دقيقة.',
    },
  },
});

app.post('/auth/login', authLimiter, loginHandler);
app.post('/auth/forgot-password', authLimiter, forgotPasswordHandler);

const userAwareLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 60,
  keyGenerator: (req) => {
    return req.user ? `user:${req.user.id}` : req.ip;
  },
});

app.use('/api', authenticateOptional, userAwareLimiter);

npm install rate-limit-redis ioredis

const { RedisStore } = require('rate-limit-redis');
const Redis = require('ioredis');

const redisClient = new Redis(process.env.REDIS_URL);

const globalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 200,
  standardHeaders: true,
  legacyHeaders: false,
  store: new RedisStore({
    sendCommand: (...args) => redisClient.call(...args),
  }),
});

const logger = require('./logger');

const globalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 200,
  standardHeaders: true,
  legacyHeaders: false,
  handler: (req, res, next, options) => {
    logger.warn({
      event: 'rate_limit_exceeded',
      ip: req.ip,
      userId: req.user?.id ?? null,
      path: req.path,
      method: req.method,
    });
    res.status(options.statusCode).json(options.message);
  },
});