Works on AWS but not on AZURE

[kanikbenzeen]

Ok so, I have implemented this rate limitter on my nodejs form post apis and the issue is that i have 2 servers one on AWS another on Azure so i have the same code deployed on both, It's working on AWS i have implemented 4 hits in 1 minute as as the paramenters it shows too many requests on the 5th one but the same code is not working on Azure

I am using all the default parameters except the time frame and hit count

const { rateLimit } = require('express-rate-limit')
const limiter = rateLimit({
	windowMs: 60 * 1000, // 1 minutes
	limit: 4, // Limit each IP to 4 requests per `window` (here, per 1 minutes).
	standardHeaders: 'draft-7', // draft-6: `RateLimit-*` headers; draft-7: combined `RateLimit` header
	legacyHeaders: false, // Disable the `X-RateLimit-*` headers.
	// store: ... , // Redis, Memcached, etc. See below.
})

[gamemaker1]

Maybe it's a reverse proxy problem? Could you try adjusting the value of trust proxy for the Azure deployment?

See https://express-rate-limit.mintlify.app/guides/troubleshooting-proxy-issues#the-global-limiter-problem.

[kanikbenzeen]

@gamemaker1, already using this

var isDevMode = process.env.NODE_ENV === 'development';
if(!isDevMode) {
    app.set('trust proxy', 1);
}

[nfriedly]

I remember something about azure putting port numbers in the x-forwarded-for header; take a look at #234

Also, there might be some info in your logs.

[kanikbenzeen]

Ok thanks for the help, Looking into this now

[kanikbenzeen]

@nfriedly used both keyGenerator and trust proxy but in asuze i dont know how its working like here in code i set the value to 4 request per minute but sometimes it gives (429 Too Many Requests) on 6th request sometime 8th sometimes 9th but the same code works perfectly well on AWS

const { rateLimit } = require('express-rate-limit')
const limiter = rateLimit({
	windowMs: 60 * 1000, // 1 minute
	limit: 4, // Limit each IP to 4 requests per windowMs
	standardHeaders: 'draft-7', // Use `RateLimit` header (draft-7)
	legacyHeaders: false, // Disable `X-RateLimit-*` headers
	keyGenerator: (req) => {
		if (!req.ip) {
			console.error('Warning: request.ip is missing!');
			return req.socket.remoteAddress;
		}
		return req.ip.replace(/:\d+[^:]*$/, '');
	},
});

var isDevMode = process.env.NODE_ENV === 'development';
if(!isDevMode) {
    app.set('trust proxy', 1);
}

[kanikbenzeen]

Can you suggest best store in my case?

[nfriedly]

I'm partial to redis/redict/valkey (they're all the same thing with different licenses, and rate-limit-redis handles all three).

However, if you're more familiar with one of the other options, then go with that.

[kanikbenzeen]

Still it gives (429 Too Many Requests) on 6th request sometime 8th sometimes 9th but the same code works perfectly well on AWS,
So, what i observed is when i was printing the ip and when i loads it multiples time it changes the port like if i click reload multiples times in a single second it shows multiple ports maximum i get is 2 different ports think when multiples request comes azure devides the load on multiple port so i thinnk this is where i am stuck

[nfriedly]

Is that with both the custom keyGenerator that strips port numbers and the external store at the same time?

Also, just out of curiosity, which store did you use?

[kanikbenzeen]

using the default memory store currently

[kanikbenzeen]

Using this code as suggested and using a route to find the ip, correct me if i am wrong this keyGenerator replaces the port with empty string and directly checks the ip only so it bypasses the milti port for the load balancing in AZURE.
But when i check this, it shows me ip with port so is it mean that the keyGenerator not working?

Result to the (ip) route - 43.249.53.43:64393
Result to the (x-forwarded-for) route - 43.249.53.43:64393

const { rateLimit } = require('express-rate-limit')
const limiter = rateLimit({
	windowMs: 60 * 1000, // 1 minute
	limit: 4, // Limit each IP to 4 requests per windowMs
	standardHeaders: 'draft-7', // Use `RateLimit` header (draft-7)
	legacyHeaders: false, // Disable `X-RateLimit-*` headers
	keyGenerator: (req) => {
		if (!req.ip) {
			console.error('Warning: request.ip is missing!');
			return req.socket.remoteAddress;
		}
		return req.ip.replace(/:\d+[^:]*$/, '');
	},
});

// Endpoint to check client IP
router.get('/ip', limiter, (req, res) => {
    res.send(req.ip);
});

// Endpoint to check X-Forwarded-For header
router.get('/x-forwarded-for', limiter, (req, res) => {
    res.send(req.headers['x-forwarded-for']);
});

[gamemaker1]

No no, it doesn't mean the key generator is not working.

keyGenerator: (req) => {
	if (!req.ip) {
		console.error('Warning: request.ip is missing!');
		return req.socket.remoteAddress;
	}
	return req.ip.replace(/:\d+[^:]*$/, '');
},

Here, the IP (without port) is returned by the keyGenerator function.

On the other hand, in the following code, you are simply printing out the IP (with the port):

// Endpoint to check client IP
router.get('/ip', limiter, (req, res) => {
    res.send(req.ip);
});

[kanikbenzeen]

Still it gives (429 Too Many Requests) on 6th request sometime 8th sometimes 9th but the same code works perfectly well on AWS,
So, what i observed is when i was printing the ip and when i loads it multiples time it changes the port like if i click reload multiples times in a single second it shows multiple ports maximum i get is 2 different ports think when multiples request comes azure devides the load on multiple port so i thinnk this is where i am stuck