Rate Limiting

Protect your API from abuse instantly. bro.js has express-rate-limit built right into the core engine.

Global Rate Limits

You can protect your entire API globally by adding a rateLimit object to bro.config.js:

export default defineConfig({
  rateLimit: {
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 100 // limit each IP to 100 requests per window
  }
});

Route-Specific Rate Limits

Need stricter limits for sensitive endpoints like login or password reset? Just override it in the specific route file:

import { defineRoute } from 'bro-framework';
 
export default defineRoute({
  rateLimit: {
    windowMs: 60 * 1000, // 1 minute
    max: 5 // Only 5 attempts per minute!
  },
  handler: async ({ body }) => {
    // Sensitive login logic...
    return { token: "..." };
  }
});

Smart Distributed Rate Limiting

If you define a redisUrl in your bro.config.js, bro.js automatically upgrades both your global and route-specific rate limiters. Instead of using in-memory tracking (which fails across multiple server instances), it seamlessly deploys a lightning-fast distributed rate limiter using atomic Redis INCR and EXPIRE operations. Zero extra configuration required!