I found that this library occasionally works and occasionally doesn't work. about express-rate-limit HOT 3 CLOSED

Thank you for your answer. I have understood why this situation occurred. I will try using Redis storage instead of the default memory store, and your guess is correct. I did mean to express' 10 times within 10 seconds', but I mistakenly typed it due to my own negligence.

from express-rate-limit.

myExpress.use(
    "/api/suggestion/create",
    rateLimit({
      windowMs: 10 * 1000,
      max: req => {
        if (
          req.headers.session &&
          validateSession(req.headers.session as string)
        ) {
          return 10;
        } else {
          return 1;
        }
      },
      message: "您的操作过于频繁，请稍后再试",
      keyGenerator: req => {
        return req.headers.session as string;
      },
    })

like this

from express-rate-limit.

I see two things that might be an issue:

      keyGenerator: req => {
        return req.headers.session as string;
      },

This should probably have a fallback for users without a session header, e.g.

      keyGenerator: req => {
        return (req.headers.session as string) || req.ip;
      },

② For example, to create a suggested interface, a user can call it up to 10 times within 10 days - I tested this with Postman, occasionally normal and occasionally abnormal, and there may be 15 successful requests, as well as the first 10 successful requests and the last five unsuccessful ones.

(I assume you meant "10 times within 10 seconds")

This is likely due to using the default MemoryStore where the time windows doesn't start with the first request, it starts when express-rate-limit is initialized and then repeats from there. So, some of the requests fall into the first 10-second window, and other requests fall into the next 10-second window, and a user could potentially get up to 20 requests in a row before having to wait 10 seconds.

Any of the external stores are going to behave closer to what you're probably expecting, where they have separate time windows for each user, starting at that user's first request: https://github.com/express-rate-limit/express-rate-limit#store If you don't want to set up a database, then the precise memory store might be the way to go: https://www.npmjs.com/package/precise-memory-rate-limit

from express-rate-limit.