Rate Limiting

TL;DR: Use createRateLimiter({limit:100, window:60000}). IP-keyed. In-memory store. Upgrade D1/KV for prod.

Table of Contents

• Config Table
• How It Works
• Headers
• Caveats
• Reset Quiz

Config Table

Tune limits per route.

From packages/hono-middleware/src/middleware/rate-limit.ts.

How It Works

In-memory Map. Resets on window expiry.

// packages/hono-middleware/src/middleware/rate-limit.ts
const store = new Map();  // key -> {count, resetAt}
 
const key = keyGenerator(c);  // cf-connecting-ip
entry.count++;
if (entry.count > limit) 429;

Imperative: Set headers always.

Headers

Standard rate limit headers.

Caveats

In-memory only. Worker restart resets.

Upgrade paths:

• Durable Objects: Per-session limits
• KV/D1: Persistent counters

Test: bun test --filter rate-limit.

Reset Quiz

Q: Entry expires when?

A: now > resetAt ✅
B: count > limit
C: Manual clear

Related

• Auth Middleware ->

Run clearRateLimitStore() in tests. Spam requests. See 429!