Rate Limiting in Fastify That Actually Works
@fastify/rate-limit + Redis is the production-grade combo. Here's the config that handles trust proxy, per-route limits, and per-user keys correctly.
Rate Limiting in Fastify That Actually Works
@fastify/rate-limit is the standard. Here's the production config.
Setup
npm install @fastify/rate-limit ioredis
import Fastify from 'fastify';
import rateLimit from '@fastify/rate-limit';
import Redis from 'ioredis';
const app = Fastify({ trustProxy: 1 });
await app.register(rateLimit, {
global: true,
max: 100,
timeWindow: '1 minute',
redis: new Redis(process.env.REDIS_URL),
keyGenerator: (req) => {
const user = (req).user; // if you've set this in an auth hook
return user?.id || req.ip;
},
skipOnError: true, // fail open if Redis is down
});
Per-route limits
Stricter on auth routes:
app.post('/auth/login', {
config: {
rateLimit: {
max: 5,
timeWindow: '5 minutes',
},
},
}, async (req, reply) => {
// login handler
});
What skipOnError does
When Redis is unreachable, the rate limiter fails open by default — requests pass through unrestricted. This prevents Redis becoming a hard dependency for your app's availability. Tradeoff: during a Redis outage, rate limits are temporarily disabled.
Verifying
for i in {1..15}; do curl -i http://localhost:3000/auth/login -d 'foo'; done
After the limit, you'll see 429 Too Many Requests with X-RateLimit-* headers indicating when to retry.
Related
Frequently Asked Questions
Does @fastify/rate-limit support per-route limits?
Yes — pass a config object to specific routes via `config.rateLimit`. Different limits per endpoint without separate plugin registrations.
Should I use the built-in store or Redis?
Redis for multi-instance. The built-in LRU store is in-memory and per-process.
What about per-user rate limiting?
Pass a `keyGenerator` function that returns the user ID for authenticated requests, falling back to IP.
Recommended reading
Part 1 of the AI Security Auditing series. Set up an AI coding agent to audit your application's security locally — install SecureNow, connect your account, and run your first threat-model pass in minutes.
Jul 24A practical, end-to-end guide to auditing your application's security with an AI coding agent — find vulnerabilities at the code level, build detections at the runtime level, and never upload your codebase to do it.
Jul 24Part 2 of the AI Security Auditing series. Use an AI agent to audit your login, session, MFA, password-reset and magic-link flows for account-takeover paths — then catch the attempts in live traffic.
Jul 23