Class: InMemoryStore

Defined in: packages/core/src/core/middleware/RateLimiter.ts:149

In-memory sliding window rate limit store.

⚠️ Single-process only. Each process maintains its own counters. In multi-instance deployments (Kubernetes, PM2 cluster, serverless), each instance has an independent counter — an attacker effectively gets max * instanceCount requests. For distributed rate limiting, implement RateLimitStore with a shared backend (Redis, Valkey).

Automatic cleanup runs every windowMs to prune expired entries.

Implements

• RateLimitStore

Constructors

Constructor

new InMemoryStore(windowMs?): InMemoryStore;

Defined in: packages/core/src/core/middleware/RateLimiter.ts:154

Parameters

Parameter	Type	Default value
windowMs	number	60_000

Returns

InMemoryStore

Methods

destroy()

destroy(): void;

Defined in: packages/core/src/core/middleware/RateLimiter.ts:201

Clean up resources (intervals, connections). Called when the server shuts down.

Returns

void

Implementation of

RateLimitStore.destroy

---

increment()

increment(key, windowMs): RateLimitEntry;

Defined in: packages/core/src/core/middleware/RateLimiter.ts:163

Check the current request count for a key within a time window. Does NOT record the request — call record() separately after confirming the request is under the limit.

Parameters

Parameter	Type	Description
key	string	Rate limit key (e.g., user ID)
windowMs	number	Time window in milliseconds

Returns

RateLimitEntry

Current count and time until window resets (in ms)

Implementation of

RateLimitStore.increment

---

record()

record(key): void;

Defined in: packages/core/src/core/middleware/RateLimiter.ts:194

Record a successful (non-rejected) request. Only called when the request is under the limit.

Parameters

Parameter	Type
key	string

Returns

void

Implementation of

RateLimitStore.record