Rate-limit exceptions in Express middleware? - express

Question

In an Express.js app, we would like to rate-limit users who hit a certain route too often, but only if they cause a certain exception. Is there a natural way to do this in Express?
Here's more or less what we have now, not rate-limited.
app.get(
"/api/method",
authenticationMiddleware,
handler
);
Rate-limiter middleware typically looks like this. It counts accesses, and errors out if the user accessed it too many times, before we even get to the handler.
app.get(
"/api/method",
authenticationMiddleware,
rateLimiterMiddleware, # <--- count, and tell them to go away if over limit
handler
);
However, we're fine with them accessing it as many times as they want - we just want to bar them if they have recently caused a lot of exceptions.
In Express, Error handlers are supposed to go at the end of the handler chain.
So it seems we have to put the "guard" at the front, and an error-handling "counter" at the end.
app.get(
"/api/method",
authenticationMiddleware,
errorIfTooManyExceptionsByUser, # <--- tell them to go away if over the limit
handler,
countExceptionsForUser # <--- count
);
This seems inelegant, and also a little tricky since the two parts of rate-limiting middleware have to know a lot about each other. Is there a better way?
Perhaps we could get clever and modify the handler(s), to do the guarding and counting before and after they run?
app.get(
"/api/method",
authenticationMiddleware,
rateLimitErrors(handler) # <-- ???
)
Am I missing something or is there a better way to do this?

Answer 1

You can maybe look at how the express-redis-cache handle his middleware (https://github.com/rv-kip/express-redis-cache/blob/df4ed8e057a5b7d41d894e6e468f975aa62206f6/lib/ExpressRedisCache/route.js#L184). They wrap the send() method of express, with their own logic. Maybe with this you can have only one middleware but i think it's not the best solution.
Express Rate Limit
There is an existing middleware which handle rate limit in express https://www.npmjs.com/package/express-rate-limit.
Nginx handling
Express is a lightweight framework, in the official doc they advice to put an Nginx in front of your express server to handle server things.
(https://expressjs.com/en/advanced/best-practice-performance.html)
Use a reverse proxy
A reverse proxy sits in front of a web app and performs supporting operations on the requests, apart from directing requests to the app. It can handle error pages, compression, caching, serving files, and load balancing among other things.
Handing over tasks that do not require knowledge of application state to a reverse proxy frees up Express to perform specialized application tasks. For this reason, it is recommended to run Express behind a reverse proxy like Nginx or HAProxy in production.
And in nginx you have a rate-limit system : https://www.nginx.com/blog/rate-limiting-nginx/. I don't know if you can customise this for your specific use case, but i think it's the best way to handle rate-limiting.