express-rate-limit 6.0.2 → 6.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "express-rate-limit",
-	"version": "6.0.2",
+	"version": "6.0.3",
 	"description": "Basic IP rate-limiting middleware for Express. Use to limit repeated requests to public APIs and/or endpoints such as password reset.",
 	"author": {
 		"name": "Nathan Friedly",
@@ -44,12 +44,12 @@
 		"changelog.md"
 	],
 	"engines": {
-		"node": ">= 12.9.0"
+		"node": ">= 14.5.0"
 	},
 	"scripts": {
 		"clean": "del-cli dist/ coverage/ *.log *.tmp *.bak *.tgz",
-		"build:cjs": "esbuild source/index.ts --bundle --format=cjs --outfile=dist/index.cjs --footer:js='module.exports = rateLimit;'",
-		"build:esm": "esbuild source/index.ts --bundle --format=esm --outfile=dist/index.mjs",
+		"build:cjs": "esbuild --bundle --format=cjs --outfile=dist/index.cjs --footer:js=\"module.exports = rateLimit;\" source/index.ts",
+		"build:esm": "esbuild --bundle --format=esm --outfile=dist/index.mjs source/index.ts",
 		"build:types": "dts-bundle-generator --out-file=dist/index.d.ts source/index.ts",
 		"compile": "run-s clean build:*",
 		"lint:code": "xo --ignore test/external/",

package/readme.md

@@ -12,7 +12,7 @@ public APIs and/or endpoints such as password reset. Plays nice with
 
 </div>
 
-### Alternate Rate-limiters
+### Alternate Rate Limiters
 
 > This module does not share state with other processes/servers by default. If
 > you need a more robust solution, I recommend using an external store. See the
@@ -72,10 +72,6 @@ requests:
 ```ts
 import rateLimit from 'express-rate-limit'
 
-// Enable if you're behind a reverse proxy (Heroku, Bluemix, AWS ELB, Nginx, etc)
-// see https://expressjs.com/en/guide/behind-proxies.html
-// app.set('trust proxy', 1);
-
 const limiter = rateLimit({
 	windowMs: 15 * 60 * 1000, // 15 minutes
 	max: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
@@ -94,10 +90,6 @@ requests:
 ```ts
 import rateLimit from 'express-rate-limit'
 
-// Enable if you're behind a reverse proxy (Heroku, Bluemix, AWS ELB, Nginx, etc)
-// see https://expressjs.com/en/guide/behind-proxies.html
-// app.set('trust proxy', 1);
-
 const apiLimiter = rateLimit({
 	windowMs: 15 * 60 * 1000, // 15 minutes
 	max: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
@@ -114,10 +106,6 @@ To create multiple instances to apply different rules to different endpoints:
 ```ts
 import rateLimit from 'express-rate-limit'
 
-// Enable if you're behind a reverse proxy (Heroku, Bluemix, AWS ELB, Nginx, etc)
-// see https://expressjs.com/en/guide/behind-proxies.html
-// app.set('trust proxy', 1);
-
 const apiLimiter = rateLimit({
 	windowMs: 15 * 60 * 1000, // 15 minutes
 	max: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
@@ -147,10 +135,6 @@ To use a custom store:
 import rateLimit from 'express-rate-limit'
 import MemoryStore from 'express-rate-limit/memory-store.js'
 
-// Enable if you're behind a reverse proxy (Heroku, Bluemix, AWS ELB, Nginx, etc)
-// see https://expressjs.com/en/guide/behind-proxies.html
-// app.set('trust proxy', 1);
-
 const apiLimiter = rateLimit({
 	windowMs: 15 * 60 * 1000, // 15 minutes
 	max: 100, // Limit each IP to 100 requests per `window` (here, per 15 minutes)
@@ -166,6 +150,38 @@ app.use('/api', apiLimiter)
 > prefixes, when using multiple instances. The default built-in memory store is
 > an exception to this rule.
 
+### Troubleshooting Proxy Issues
+
+If you are behind a proxy/load balancer (usually the case with most hosting
+services, e.g. Heroku, Bluemix, AWS ELB, Nginx, Cloudflare, Akamai, Fastly,
+Firebase Hosting, Rackspace LB, Riverbed Stingray, etc.), the IP address of the
+request might be the IP of the load balancer/reverse proxy (making the rate
+limiter effectively a global one and blocking all requests once the limit is
+reached) or `undefined`. To solve this issue, add the following line to your
+code (right after you create the express application):
+
+```ts
+app.set('trust proxy', numberOfProxies)
+```
+
+Where `numberOfProxies` is the number of proxies between the user and the
+server. To find the correct number, create a test endpoint that returns the
+client IP:
+
+```ts
+app.set('trust proxy', 1)
+app.get('/ip', (request, response) => response.send(request.ip))
+```
+
+Go to `/ip` and see the IP address returned in the response. If it matches your
+IP address (which you can get by going to http://ip.nfriedly.com/ or
+https://api.ipify.org/), then the number of proxies is correct and the rate
+limiter should now work correctly. If not, then keep increasing the number until
+it does.
+
+For more information about the `trust proxy` setting, take a look at the
+[official Express documentation](https://expressjs.com/en/guide/behind-proxies.html).
+
 ## Request API
 
 A `request.rateLimit` property is added to all requests with the `limit`,