How to Build Three-Layer Rate Limiting in Node.js to Stop API Abuse

A developer writing for DEV Community describes a practical approach to API rate limiting in Node.js after discovering a credential-stuffing bot making 200 login attempts per minute against a public endpoint. The solution was built in layers: starting with in-memory limits using express-rate-limit for single-instance setups, then distributed limits via Redis for multi-instance deployments, followed by a token bucket algorithm for endpoints with bursty traffic. Tighter per-IP limits — such as five login attempts per 15 minutes — are recommended for authentication routes to make brute-force attacks economically unviable. The author cautions that in-memory rate limiting alone is insufficient in load-balanced environments, as counters are not shared across instances. The same three-layer design has reportedly held up against scraping campaigns and runaway client loops over two years of production use.