{
  "id": 397874,
  "title": "How I Protected My Express API from Spam and High AI Costs Using Redis",
  "url": "https://urgent.news/2026/08/09/how-i-protected-my-express-api-from-spam-and-high-ai-costs-using-redis",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-09T18:24:10.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/nikhil_singh_e20fff10a888/how-i-protected-my-express-api-from-spam-and-high-ai-costs-using-redis-40c"
  },
  "original_language": "en",
  "account": "My backend API faced a major issue: it was vulnerable to spam attacks and high costs related to external AI services. To address this, I implemented rate limiting using Redis. In-memory solutions, like a JavaScript object to track request counts, proved ineffective due to memory leaks and scaling issues. Redis offers a centralized solution, storing data in RAM outside the Node.js app, ensuring that all server instances share the same count. I configure two levels of protection: a global limit of 100 requests per 15 minutes for regular routes, and a stricter limit of 5 requests per 10 minutes for heavy routes such as AI generation or OTP emails. To set up this rate limiting, I first establish a Redis connection in the `config/redis.js` file using the `redis` package. Then, I create middleware in `middlewares/rateLimiter.js` utilizing the `express-rate-limit` and `rate-limit-redis` packages. The global limiter is applied to all routes with a window of 15 minutes and a limit of 100 requests, while the strict limiter is applied to heavy routes with a window of 10 minutes and a limit of 5 requests. Finally, the rate limiters are applied to the specific routes, ensuring my Express API remains protected from spam and costly AI service usage.",
  "summary": "When I was building my backend API, I realized a big problem: anyone could spam my endpoints. If a user repeatedly reloads a page or hits an endpoint calling an external AI service, it can crash the server or run up high API costs. To fix this, I added Rate Limiting . Here is why I used Redis for it and how I set it up. The Problem with Simple In-Memory Limiters At first, I thought about saving…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}