How do you implement rate limiting in Express.js?

Question

Accepted Answer

**Rate limiting** — restricts number of requests per time window.

**Using express-rate-limit:**
```javascript
const rateLimit = require("express-rate-limit");

const limiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 100, // limit per window
    message: "Too many requests",
    standardHeaders: true,
    legacyHeaders: false,
});

app.use("/api/", limiter);
```

**Custom rate limiter with Redis:**
```javascript
const RedisStore = require("rate-limit-redis");
const redis = require("redis").createClient();

app.use(rateLimit({
    store: new RedisStore({
        sendCommand: (...args) => redis.sendCommand(args),
    }),
    windowMs: 15 * 60 * 1000,
    max: 100,
}));
```

**Key points:**
- Use Redis for distributed rate limiting.
- Set X-RateLimit headers for clients.
- Different limits for different endpoints.

Node.js: How do you implement rate limiting in Express.js?