การจำกัดอัตราและการป้องกันการเดาแบบลองทุกกรณี

Without limits, a single client can hammer your API thousands of times per second — scraping data, guessing passwords, or simply overloading the server.

Rate limiting caps how many requests a client may make in a time window.

Rate limiting is a frontline defense against:

• Brute-force login attempts
• Credential stuffing with leaked passwords
• Denial-of-service floods
• Scraping and API abuse

A rate limiter tracks a counter per client (usually keyed by IP). Each request increments it; when the count exceeds the limit within the window, further requests are rejected with 429 Too Many Requests.

The express-rate-limit package adds rate limiting as middleware in a few lines. Configure the window and max requests.

Apply globally with app.use, or to specific routes. Once over the limit, clients automatically receive a 429 response.

Login endpoints are prime brute-force targets, so give them a tighter limit than the rest of your API.

The default in-memory store does not work when you run multiple instances behind a load balancer — each has its own counter. Use a shared store like Redis so limits apply across all servers.

Behind a proxy, every request appears to come from the proxy's IP. Tell Express to trust the proxy so the limiter keys on the real client IP from X-Forwarded-For.

Beyond IP limits, track failed logins per account. After several failures, temporarily lock the account or require a CAPTCHA — defeating distributed brute-force from many IPs.

An alternative to hard blocks is progressive delay: each repeated request waits a little longer. The express-slow-down package adds latency rather than rejecting outright.

Good limiters send RateLimit headers telling clients their remaining quota and reset time, so well-behaved apps can back off gracefully.

Test your rate-limiting knowledge.

You learned to protect APIs from abuse:

• Rate limiting caps requests per client and returns 429 when exceeded
• express-rate-limit adds it as middleware; use stricter limits on login
• Use a Redis store across multiple servers and set trust proxy for real IPs
• Add account lockout, progressive slow-down, and informative headers

These layers thwart brute-force, scraping, and DoS attacks.