Rate limiting middleware for Hono. Use to limit repeated requests to public APIs and/or endpoints such as password reset.

import { rateLimiter } from "hono-rate-limiter";

const limiter = rateLimiter({
  windowMs: 15 * 60 * 1000, // 15 minutes
  limit: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes).
  standardHeaders: "draft-6", // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
  keyGenerator: (c) => "<unique_key>", // Method to generate custom identifiers for clients.
  // store: ... , // Redis, MemoryStore, etc. See below.
});

// Apply the rate limiting middleware to all requests.
app.use(limiter);

hono-rate-limit supports external data stores to synchronize hit counts across multiple processes and servers.

By default, MemoryStore is used. This one does not synchronize its state across instances. It’s simple to deploy, and often sufficient for basic abuse prevention, but will be inconnsistent across reboots or in deployments with multiple process or servers.

Deployments requiring more consistently enforced rate limits should use an external store.

Here is a list of stores:

Take a look at this guide if you wish to create your own store.

We would love to have more contributors involved!

To get started, please read our Contributing Guide.

The hono-rate-limiter project is heavily inspired by express-rate-limit