IPv6-Aware Rate Keys

Design an Express middleware factory that limits requests per client while grouping IPv6 traffic by subnet when desired. The middleware should rely on the provided rate-limiting dependency to derive IP-based keys, expose the computed key to downstream handlers, and allow toggling between masked IPv6 keys and exact addresses.

Capabilities

IPv6 subnet grouping

• With options limit: 1, windowMs: 60000, and default IPv6 subnet masking, two requests coming from 2001:db8:1:2::10 and 2001:db8:1:2::99 share the same quota, so the first request succeeds and the second receives a 429 response because they map to the same masked key. @test

Raw IPv6 keys when disabled

• With options limit: 1, windowMs: 60000, and IPv6 subnet masking disabled, requests from 2001:db8:1:2::10 and 2001:db8:1:2::99 are treated as separate clients so both requests succeed without tripping the limit. @test

IPv4 key isolation

• IPv4 requests such as 203.0.113.10 and 203.0.113.44 always produce separate keys; with limit: 1, each IP can make one request without affecting the other. @test

Request metadata exposure

• The computed client key is attached to the request under a configurable property (default rateLimitKey) before the route handler runs; a handler that echoes this property returns the masked IPv6 key when subnetting is enabled and the exact address when it is disabled. @test

Implementation

@generates

API

import { RequestHandler } from "express";

export interface RateLimiterOptions {
  windowMs?: number;
  limit?: number;
  ipv6Subnet?: number | false; // defaults to masked IPv6 keys using the dependency's default subnet when omitted
  requestPropertyName?: string; // defaults to "rateLimitKey"
}

export function buildRateLimiter(options?: RateLimiterOptions): RequestHandler;

Dependencies { .dependencies }

express-rate-limit { .dependency }

Provides rate-limiting middleware with IPv6-aware IP key generation. @satisfied-by