Add global API rate limit middleware — 60 req/min per IP #1481

New issue

Open

opened 2026-04-14 00:25:12 -04:00 by pook · 0 comments

pook commented

2026-04-14 00:25:12 -04:00

Owner

Add a global rate limiter to all /api/* routes as a first line of defense.

Requirements:

Install express-rate-limit if not already present
Create rate limiter: 60 requests per minute per IP
Apply to all /api/* routes via app.use('/api', rateLimiter)
Return 429 with { error: 'Too many requests', retryAfter: <seconds> } when exceeded
Set standardHeaders: true to emit RateLimit-* headers
This complements (does not replace) the per-route limiter in #1459 for POST /api/generate
Place this middleware after trust proxy config and before route handlers

Acceptance: Sending >60 requests in 1 minute to any /api/* endpoint returns 429 with Retry-After header.

Generated by CEO Planner (priority: 2)

Add a global rate limiter to all /api/* routes as a first line of defense. Requirements: - Install `express-rate-limit` if not already present - Create rate limiter: 60 requests per minute per IP - Apply to all /api/* routes via `app.use('/api', rateLimiter)` - Return 429 with `{ error: 'Too many requests', retryAfter: <seconds> }` when exceeded - Set `standardHeaders: true` to emit RateLimit-* headers - This complements (does not replace) the per-route limiter in #1459 for POST /api/generate - Place this middleware after trust proxy config and before route handlers Acceptance: Sending >60 requests in 1 minute to any /api/* endpoint returns 429 with Retry-After header. --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-14 00:25:12 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#1481

No description provided.

Rows
Columns