What happens if memcached in unavailable?

[ngdaddikar]

Hi,

If memcached server is down how does the express rate limiter behave? Does it give an error? Is there a "fallback" mechanism?

Thanks.

[nfriedly]

It will go to Express's error handler - http://expressjs.com/en/guide/error-handling.html#the-default-error-handler

There was some discussion of making a configuration option to "fail open" and allow unlimited requests through if the datastore goes down. This would be in express-rate-limit so that it could apply to all data stores, but no work has been done on that yet.

[ngdaddikar]

I am new to node-js. Is there any example on how to bypass errors in the the rate limiter i.e let all requests go through when the store is down. Thanks.

…

On 23-Oct-2023, at 6:31 PM, Nathan Friedly ***@***.***> wrote: It will go to Express's error handler - http://expressjs.com/en/guide/error-handling.html#the-default-error-handler There was some discussion of making a configuration option to "fail open" and allow unlimited requests through if the datastore goes down. This would be in express-rate-limit so that it could apply to all data stores, but no work has been done on that yet. — Reply to this email directly, view it on GitHub <#8 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADGMHCL4TYTBDMSTVR36DKTYAZTEBAVCNFSM6AAAAAA6LNX2Y2VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TGNJYGY3DS>. You are receiving this because you authored the thread.

[nfriedly]

You could write your own wrapper, something like this:

const limiter = rateLimit({ /* ... */ });
app.use((req, res, next) => {
  limiter(req, res, (err) => {
    if (err) {
      console.error('error from express-rate-limit, allowing request', err);
    }
    next();
  }
});

That will log the error and then continue handling the request as if the limiter was allowed. It's not a great idea, because if a malicious user figured out a way to reliably trigger errors, they'd be able to bypass your limiter. (Also, this example ignores all errors, not just store-related ones.) But, it would allow you to prioritize availability over rate-limiting.