A slow down plugin for fastify

Installation

npm i fastify-slow-down

Usage

Register SlowDown as a Fastify plugin. This plugin will add an onRequest hook to slow down replies if a client (based on their IP address by default) has made too many multiple requests in the given timeWindow and it will add slowDown request decorator, which is an object with the following properties:

Name	Type	Description
limit	number	the maximum limit until the server starts to delay the response
current	number	the index of the current request
remaining	number	how many requests are left until the server starts to delay the response
delay	number | undefined	value of the delay (in milliseconds) applied to this request

import Fastify from 'fastify'
import slowDownPlugin from 'fastify-slow-down'

const fastify = Fastify()

// register the plugin
fastify.register(slowDownPlugin)

// create a route
fastify.get('/', async () => 'Hello from fastify-slow-down!')

// start server
await fastify.listen({ port: 3000 })

The response will have some additional headers:

Header	Description
x-slow-down-limit	how many requests in total the client can make until the server starts to slow down the response
x-slow-down-remaining	how many requests remain to the client in the timeWindow
x-slow-down-delay	how much delay (in milliseconds) has been applied to this request

Configuration

Name	Type	Default Value	Description
delay	string | number	1 second	Base unit of time delay applied to requests. It can be expressed in milliseconds or as string in ms format. Set to 0 to disable delaying.
delayAfter	number	5	number of requests received during timeWindow before starting to delay responses. Set to 0 to disable delaying.
maxDelay	string, number	Infinity	the maximum value of delay that a request has after many consecutive attempts. It is an important option for the server when it is running behind a load balancer or reverse proxy, and has a request timeout. Set to 0 to disable delaying.
timeWindow	string |, number	30 seconds	The duration of the time window during which request counts are kept in memory. It can be expressed in milliseconds or as a string in ms format. Set to 0 to disable delaying.
inMemoryCacheSize	number	5000	The maximum number of items that will be stored in the in-memory cache (this plugin internally uses a lru cache to handle the clients, you can change the size of the cache with this option)
redis	Redis client instance from the ioredis package	undefined	by default this plugin uses an in-memory store, but if your application works on more than one server it is useless, since the data is stored locally. You can pass a Redis client here and magically the issue is solved. To achieve the maximum speed, this plugin requires the use of ioredis. Note: the default parameters of a redis connection are not the fastest to provide a slow-down. We suggest to customize the connectTimeout and maxRetriesPerRequest as in the example.
headers	boolean	true	flag to add custom headers x-slow-down-limit, x-slow-down-remaining, x-slow-down-delay for all server responses.
keyGenerator	function	(req) => req.ip	Function used to generate keys to uniquely identify requests coming from the same user
onLimitReached	function	undefined	Function that gets called the first time the limit is reached within timeWindow.
skipFailedRequests	boolean	false	When true, failed requests (status >= 400) won't be counted.
skipSuccessfulRequests	boolean	false	When true, successful requests (status < 400) won't be counted.
skip	function	undefined	Function used to skip requests. Returning true from the function will skip limiting for that request.

Example with configuration

Registering the plugin with these options:

fastify.register(slowDownPlugin, {
  delay: '10 seconds',
  delayAfter: 10,
  timeWindow: '10 minutes',
  maxDelay: '100 seconds'
})

A delay specified via the delay option will be applied to requests coming from the same IP address (by default) when more than delayAfter requests are received within the time specified in the timeWindow option.

In 10 minutes the result of hitting the API will be:

• 1st request - no delay
• 2nd request - no delay
• 3rd request - no delay
• ...
• 10th request - no delay
• 11th request - 10 seconds delay
• 12th request - 20 seconds delay
• 13th request - 30 seconds delay
• ...
• 20th request - 100 seconds delay
• 21st request - 100 seconds delay*

After 10 minutes without hitting the API the results will be:

• 21th request - no delay
• 21th request - no delay
• ...
• 30th request - no delay
• 31th request - 10 seconds delay

*Delay remains the same because the value of maxDelay option is 100 seconds

Integration with fastify-rate-limit

The plugin slows down the response without stopping it at a certain limit. This can put the server in a difficult situation because the client can make many requests without waiting for a response. To limit the number of requests, it should be used together with the fastify-rate-limit plugin.

See in this example which is the implementation using fastify-slow-down and fastify-rate-limit plugins.

If the delayAfter value of the fastify-slow-down package is set to be less than the max value of the fastify-rate-limit package, then you will see the responses being delayed once the delayAfter value has been exceeded, by the number of ms as specified in the delay value.

However, once the max value from the fastify-rate-limit package has been exceeded, then as expected you will still have rate limit errors returned but they will also be delayed according to the delay value from the fastify-slow-down package assuming that the delayAfter value has also been exceeded.