I don't know if I'm supposing too much, but maybe that "rate-limit" logic can be set on the load balancer (if you use any of them on your setup), so you don't actually need to add specific logic to your Node.js server and complicate things. Some links: https://devcentral.f5.com/articles/where-you-rate-limit-apis-matters-21384 https://www.haproxy.com/blog/use-a-load-balancer-as-a-first-row-of-defense-against-ddos/ https://www.nginx.com/blog/rate-limiting-nginx/