Rate Limiting

概要

This skill provides a robust architecture for implementing rate limiting in modern web applications, specifically designed to safeguard against common security threats like credential stuffing and distributed brute force attacks. By capping request frequency to five attempts per minute per IP address, it effectively neutralizes automated bots while maintaining a seamless experience for legitimate users. Beyond security, it serves as a critical cost-management tool for resource-heavy operations like AI API calls and file uploads, ensuring that unexpected spikes in traffic or malicious usage don't lead to infrastructure exhaustion or budget overruns.

主な機能

• IP-based tracking using x-forwarded-for for proxy and load balancer support
• Standardized HTTP 429 response handling with Retry-After headers
• 1 GitHub stars
• High-performance in-memory tracking with minimal database overhead
• Automatic cleanup of expired rate limit entries to manage memory usage
• Middleware implementation compatible with Next.js and Node.js runtimes

ユースケース

• Limiting usage of expensive AI generation APIs to prevent massive billing spikes
• Preventing automated bots from spamming contact forms and newsletter subscriptions
• Securing authentication endpoints and password reset forms against brute force attacks