Rate Limiting in TypeScript: Libraries and Examples |…

Rate Limiting in TypeScript: A Complete Guide to Tools and Implementation

Rate limiting is one of the key techniques for protecting web applications and APIs from abuse, DDoS attacks, and excessive load. In TypeScript, thanks to strict typing and modern capabilities, implementing rate limiting becomes particularly elegant and reliable. In this article, we will explore the best libraries, algorithms, and code examples for TypeScript.

Why is Rate Limiting Needed?

Without rate limiting, your application may face:

Server overload — a single client can send thousands of requests per second
Brute-force attacks — password or token guessing
Financial losses — if each request requires paid resources (e.g., OpenAI API)
Uneven resource distribution — one user can consume all the bandwidth

Popular Libraries for Rate Limiting in TypeScript

1. `bottleneck` — Universal Limiter

One of the most popular libraries for rate limiting in JavaScript/TypeScript. It supports both limiting the number of requests per second/minute and "hanging" (queuing) requests.

import Bottleneck from 'bottleneck';

const limiter = new Bottleneck({  maxConcurrent: 2,        // maximum 2 concurrent requests  minTime: 1000,           // minimum 1 second between requests  reservoir: 10,           // total limit per period  reservoirRefreshAmount: 10,  reservoirRefreshInterval: 60 * 1000 // refresh every minute});

async function fetchData(url: string): Promise<any> {  return limiter.schedule(() => fetch(url));}

// Usageconst users = await Promise.all([  fetchData('/api/users/1'),  fetchData('/api/users/2'),  fetchData('/api/users/3'), // this request will wait]);

2. `express-rate-limit` — For Express.js

A standard solution for rate limiting in Express applications. Works great with TypeScript.

import express from 'express';import rateLimit from 'express-rate-limit';

const app = express();

const apiLimiter = rateLimit({  windowMs: 15 * 60 * 1000, // 15 minutes  max: 100,                 // maximum 100 requests  standardHeaders: true,    // return RateLimit-* headers  legacyHeaders: false,  message: {    status: 429,    message: 'Too many requests, please try again later'  }});

app.use('/api/', apiLimiter);

app.listen(3000);

3. `rate-limiter-flexible` — Flexible Solution for Redis and In-Memory Storage

A library with support for various storage backends (Redis, Memory, MongoDB, Postgres) and algorithms (Token Bucket, Sliding Window).

import { RateLimiterMemory } from 'rate-limiter-flexible';

const rateLimiter = new RateLimiterMemory({  points: 5,        // 5 requests  duration: 1,      // per 1 second});

async function checkRateLimit(key: string): Promise<boolean> {  try {    await rateLimiter.consume(key);    return true; // request allowed  } catch (error) {    return false; // limit exceeded  }}

// Example usage in Expressapp.post('/api/login', async (req, res) => {  const allowed = await checkRateLimit(req.ip);  if (!allowed) {    return res.status(429).json({ error: 'Too Many Requests' });  }  // handle login...});

Rate Limiting Algorithms

Token Bucket — a "bucket" with tokens that are replenished at a constant rate. Each request consumes one token. Allows short bursts.
Sliding Window — a sliding time window (e.g., 1 minute). Takes into account requests not over fixed intervals, but over the last