A brute-force protection middleware for express routes that rate-limits incoming requests, increasing the delay with each request in a fibonacci-like sequence. Installation via npm: $ npm install express-brute A Simple Example var ExpressBrute = require('express-brute'); // stores state locally, don't use this in production var store = new ExpressBrute.MemoryStore(); var bruteforce = new ExpressBrute(store); app.post('/auth', bruteforce.prevent, // error 429 if we hit this route too often function (req, res, next) { res.send('Success!'); }); Classes ExpressBrute(store, options) store An instance of ExpressBrute.MemoryStore or some other ExpressBrute store (see a list of known stores below). options freeRetries The number of retries the user has before they need to start waiting (default: 2) minWait The initial wait time (in milliseconds) after the user runs out of retries (default: 500 milliseconds) maxWait The maximum amount of time (in milliseconds) between requests the user needs to wait (default: 15 minutes). The wait for a given request is determined by adding the time the user needed to wait for the previous two requests. lifetime The length of time (in seconds)
Common questions about express-brute including features, pricing, alternatives, and user reviews.
express-brute is A brute-force protection middleware for express routes that rate-limits incoming requests. It is a Application Security solution designed to help security teams with Brute Force.
express-brute is a free Application Security tool. This makes it accessible for organizations of all sizes, from startups to enterprises. Visit https://github.com/AdamPflug/express-brute/ for download and installation instructions.
Popular alternatives to express-brute include:
Compare these tools and more at https://cybersectools.com/categories/application-security
express-brute is for security teams and organizations that need Brute Force. It's particularly suitable for small to medium-sized teams looking for cost-effective solutions. Other Application Security tools can be found at https://cybersectools.com/categories/application-security
Advanced rate limiting solution for web apps and APIs with AI-driven controls