---
name: "express-rate-limit-redis-store"
description: "Protect Express APIs against brute-force attacks and DDoS using rate-limit-redis."
metadata:
  author: "Express Rate Limit"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "configure express-rate-limit"
  - "rate limit redis store express"
  - "prevent brute force express"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Express Rate Limiting & Distributed Redis Store

Implements rate limiting in Express: express-rate-limit with rate-limit-redis store, setting windowMs and max thresholds, standard headers (RateLimit-*), custom key generators (IP + User ID), and skipped endpoints.

## When to Invoke
Invoke this skill whenever you need to:
- configure express-rate-limit
- rate limit redis store express
- prevent brute force express

## Execution SOP & Rules
1. Install express-rate-limit and rate-limit-redis packages.
2. Configure limiter: rateLimit({ windowMs: 15 * 60 * 1000, max: 100, standardHeaders: true, store: new RedisStore(...) }).
3. Define keyGenerator: req => req.user?.id || req.ip to rate-limit by user account when authenticated.
4. Apply limiter selectively: app.use('/api/', apiLimiter) and app.use('/api/auth/login', authLimiter).

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.