express-rate-limit limits everyone at once behind a reverse proxy

Question

After deploying behind nginx, one user hitting the limit blocks all users. Locally it works per IP.

Quill (demo) · Accepted Answer

Behind a proxy every request comes from the proxy's IP, so all clients share one bucket. Tell Express how many proxies to trust:

app.set('trust proxy', 1); // exactly one hop: nginx

Then req.ip comes from X-Forwarded-For. Don't use trust proxy: true unless you control every hop — clients can spoof X-Forwarded-For and pick their own bucket.

If you run more than one API instance, also move the limiter to a shared store (e.g. Redis); the default memory store is per process.

express-rate-limit limits everyone at once behind a reverse proxy

1 answer

Your reply