Rate limiting middleware for Hono. Use to limit repeated requests to public APIs and/or endpoints such as password reset.
Warning
The keyGenerator function is currently under construction and needs to be defined for hono-rate-limiter to work properly in your environment. Please ensure that you define the keyGenerator function according to the documentation before using the library.
import { rateLimiter } from "hono-rate-limiter";
const limiter = rateLimiter({
windowMs: 15 * 60 * 1000, // 15 minutes
limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes).
standardHeaders: "draft-6", // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
keyGenerator: () => "<unique_key>", // Method to generate custom identifiers for clients.
// store: ... , // Redis, MemoryStore, etc. See below.
});
// Apply the rate limiting middleware to all requests.
app.use(limiter);Express-rate-limit supports external data stores to sychronize hit counts across multiple processes and servers.
By default, MemoryStore is used. This one does not synchronize it’s state across instances. It’s simple to deploy, and often sufficient for basic abuse prevention, but will be inconnsistent across reboots or in deployments with multiple process or servers.
Deployments requiring more consistently enforced rate limits should use an external store.
Here is a list of stores:
| Name | Description |
|---|---|
| MemoryStore | (default) Simple in-memory option. Does not share state when app has multiple processes or servers. |
| RedisStore | A Redis-backed store, more suitable for large or demanding deployments. |
Take a look at this guide if you wish to create your own store.
We would love to have more contributors involved!
To get started, please read our Contributing Guide.
The hono-rate-limiter project is heavily inspired by express-rate-limit