Rate Limiting

Complete rate limit example

import { Volt, rateLimitPlugin } from 'voltts';

const app = new Volt();
app.plugin(rateLimitPlugin({
  windowMs: 60000,
  max: 3,
  // One shared bucket for this demo. Use a trusted identity in a real app.
  keyGenerator: () => 'tutorial',
}));
app.get('/limited', () => ({ ok: true }));
if (globalThis._importMeta_.main) app.listen(3000);
export default app;

Reach the limit

bun run index.ts
for i in 1 2 3 4; do curl -i http://localhost:3000/limited; done

The fourth request returns 429 with Retry-After and limit headers. windowMs is milliseconds. The plugin uses a counter with a reset window; it is not a token bucket. rateLimitPlugin is the plugin export; rateLimit is the separate core middleware.

Store and identity

The default MemoryRateLimitStore is process-local. A custom store must implement increment and resetKey. A key generator should use a trusted identity. The built-in default reads forwarding headers, which must be stripped or set by a trusted proxy; clients must not be able to choose their own rate-limit identity. Rate limiting is one layer of abuse protection.