The Complete Production SOP: How to Deploy and Run Express Rate Limiting & Distributed Redis Store in Autonomous AI Agents

import rateLimit from 'express-rate-limit';
import { RedisStore } from 'rate-limit-redis';
import { createClient } from 'redis';
import type { Request, Response } from 'express';

export const redisClient = createClient({
  url: process.env.REDIS_URL || 'redis://localhost:6379'
});

redisClient.on('error', (err) => console.error('Redis Client Error', err));

export async function initRedis(): Promise<void> {
  if (!redisClient.isOpen) {
    await redisClient.connect();
  }
}

// General API Limiter: 100 requests per 15 minutes
export const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  standardHeaders: 'draft-7',
  legacyHeaders: false,
  store: new RedisStore({
    sendCommand: (...args: string[]) => redisClient.sendCommand(args),
    prefix: 'rl:api:'
  }),
  keyGenerator: (req: Request): string => {
    // Rate-limit by authenticated user ID if present; fallback to IP
    return (req as any).user?.id || req.ip || 'anonymous';
  },
  message: {
    statusCode: 429,
    error: 'Too Many Requests',
    message: 'Quota exceeded. Please try again later.'
  }
});

// Stricter Auth Limiter: 5 attempts per 15 minutes to thwart brute-force
export const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  standardHeaders: 'draft-7',
  legacyHeaders: false,
  store: new RedisStore({
    sendCommand: (...args: string[]) => redisClient.sendCommand(args),
    prefix: 'rl:auth:'
  }),
  skipSuccessfulRequests: true,
  keyGenerator: (req: Request): string => {
    const email = req.body?.email ? String(req.body.email).toLowerCase() : '';
    return `auth:${req.ip}:${email}`;
  },
  message: {
    statusCode: 429,
    error: 'Too Many Requests',
    message: 'Too many failed login attempts. Account temporarily throttled.'
  }
});

import express from 'express';
import { apiLimiter, authLimiter, initRedis } from './middleware/rateLimiter';

const app = express();

// CRITICAL: Enable 'trust proxy' if behind reverse proxies (Nginx, Cloudflare, ALB)
// Pass true or the specific number of proxy hops (e.g., 1)
app.set('trust proxy', 1);

app.use(express.json());

// Selective application of rate limiters
app.use('/api/', apiLimiter);
app.post('/api/auth/login', authLimiter, (req, res) => {
  res.json({ message: 'Authentication route placeholder' });
});

export { app, initRedis };

Agent identified skill match: express-rate-limit-redis-store
Loading SOP: Express Rate Limiting & Distributed Redis Store...
Executing Step 1: Validating packages express-rate-limit, rate-limit-redis, redis...
Executing Step 2: Instantiating RedisStore wrapper with sendCommand...
Executing Step 3: Defining composite keyGenerator (IP + email/userId)...
Applying standardHeaders: draft-7...

import request from 'supertest';
import { app, initRedis, redisClient } from '../src/app';

describe('Distributed Rate Limiting Middleware', () => {
  beforeAll(async () => {
    await initRedis();
  });

  afterAll(async () => {
    await redisClient.quit();
  });

  it('should return RateLimit draft-7 headers on successful request', async () => {
    const res = await request(app).get('/api/health');
    expect(res.headers).toHaveProperty('ratelimit-limit');
    expect(res.headers).toHaveProperty('ratelimit-remaining');
    expect(res.headers).toHaveProperty('ratelimit-reset');
  });

  it('should enforce 429 Too Many Requests when auth threshold exceeded', async () => {
    for (let i = 0; i < 5; i++) {
      await request(app)
        .post('/api/auth/login')
        .send({ email: '[email protected]' });
    }
    const throttledRes = await request(app)
      .post('/api/auth/login')
      .send({ email: '[email protected]' });

    expect(throttledRes.status).toBe(429);
    expect(throttledRes.body.error).toBe('Too Many Requests');
  });
});