Why should you care?

Credential stuffing and DDoS can overwhelm MongoDB and Express without throttles.

See it live — copy this example

Paste into your MeanVerse project (Angular + Express + MongoDB), then run with ng serve / node / mongosh as noted.

import rateLimit from 'express-rate-limit';
import RedisStore from 'rate-limit-redis';
import { createClient } from 'redis';

const redis = createClient({ url: process.env.REDIS_URL });
await redis.connect();

export const authLimiter = rateLimit({
  store: new RedisStore({ sendCommand: (...args) => redis.sendCommand(args) }),
  windowMs: 15 * 60 * 1000,
  max: 10,
  standardHeaders: true,
  message: { code: 'RATE_LIMIT', message: 'Too many login attempts' }
});

app.use('/api/auth/login', authLimiter);

What happened?

• Redis store shares counters across API pods.
• 10 attempts per 15 minutes per key.
• standardHeaders sends Retry-After for clients.

Practice next

1. Apply strict limit on /auth/login and /auth/forgot.
2. Looser limit on general /api with user id key after auth.
3. Return 429 JSON consistent with ApiError.
4. Key limiter by user id after JWT parsed.
5. Add sliding window for transfer endpoint.

Remember

Rate limit at edge or Express. Redis backend for distributed counts. Different limits for auth vs read APIs.

Login attack

10k password guesses/min hit MeanVerse auth.

Outcome: 429 responses; account lockout policy triggers alerts.