Rate limiting restricts the number of requests a client can make during a specified time window.

For example, a login endpoint might allow only a limited number of attempts from a particular IP address within a time window.

We will use express-rate-limit.

Rate limiting helps reduce brute-force attempts and excessive resource consumption.

For distributed deployments, configure a shared rate-limit store rather than relying on independent in-memory counters.

import rateLimit from 'express-rate-limit';

export const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 100,
  standardHeaders: 'draft-8',
  legacyHeaders: false,
  message: {
    success: false,
    message: 'Too many requests. Please try again later.'
  }
});

app.use('/api', apiLimiter);