Multiple rate limits with different window sizes not working properly about express-rate-limit HOT 6 CLOSED

I added a custom key generator, so now it's OK.
The problem is the key is shared between different rate limiters, so using different keys solves the problem.

In my particular case, I need a custom rate limit per route, so this is the implementation for that:

import rateLimit from 'express-rate-limit';
import RedisStore from 'rate-limit-redis';
import { createClient } from 'redis';

const client = createClient();

client.connect();

export const apiLimiter = rateLimit({
  windowMs: 30 * 1000, // 30 seconds
  max: 100,
  standardHeaders: true,
  legacyHeaders: false,
  keyGenerator: req => `[${req.method}] ${req.path}@${req.ip}`,
  store: new RedisStore({
    sendCommand: (...args: string[]) => client.sendCommand(args),
  }),
});

export const paymentLimiter = rateLimit({
  windowMs: 1000, // 1 second
  max: 1,
  standardHeaders: true,
  legacyHeaders: false,
  keyGenerator: req => `[${req.method}] ${req.path}@${req.ip}`,
  store: new RedisStore({
    sendCommand: (...args: string[]) => client.sendCommand(args),
  }),
});

from express-rate-limit.

Hi,

You are right, the reset header should show 1 for the last request. Let me try reproducing this issue locally, then debug from there.

Regards

from express-rate-limit.

I tested with default store, and works fine.

The problem is using Redis, but I need it, because I have a node cluster.

from express-rate-limit.

Ohkay that's great! I'll add this to the common issues section in the wiki.

from express-rate-limit.

I can confirm this is still a problem. The suggestion of using a custom key fixed the issue for me - thanks for the tip!

from express-rate-limit.

@tbell511 Did you get an error logged to the console about double-counting, or did you find this first?

from express-rate-limit.