On each request, increments the counter for the resolved key. If count > max,
short-circuits with a 429 response (Retry-After and RateLimit-* headers set,
next() NOT called). Otherwise sets the headers and proceeds to next().
Registered globally — the usage below, and the one the README shows — the
limiter sees the operational probes too, so
RateLimitOptions.exclude exempts them by default. Widen or
narrow that list rather than dropping it: an exhausted bucket that refuses
/live gets the container restarted.
app.middleware.add(rateLimitMiddleware({ windowMs:60000, max:100, // The six operational paths are exempt by default; add your own. exclude: [...DEFAULT_RATE_LIMIT_EXCLUDED_PATHS, /^/internal//], }));
Rate limiting middleware factory.
On each request, increments the counter for the resolved key. If count > max, short-circuits with a 429 response (Retry-After and RateLimit-* headers set, next() NOT called). Otherwise sets the headers and proceeds to next().
Registered globally — the usage below, and the one the README shows — the limiter sees the operational probes too, so
RateLimitOptions.excludeexempts them by default. Widen or narrow that list rather than dropping it: an exhausted bucket that refuses/livegets the container restarted.