⚠️

重要前提

安装AI Skills的关键前提是：必须科学上网，且开启TUN模式，这一点至关重要，直接决定安装能否顺利完成，在此郑重提醒三遍：科学上网，科学上网，科学上网。查看完整安装教程 →

API速率限制算法实现：令牌桶、滑动窗口、固定窗口详解与Node.js/Express最佳实践

api-rate-limiting by secondsky/claude-skills

105 周安装量

107 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/secondsky/claude-skills --skill api-rate-limiting

Node.js API 安全

🇨🇳中文介绍

API 速率限制

使用基于用户和端点的速率限制算法来保护 API 免受滥用。

算法

算法	优点	缺点
令牌桶	处理突发流量，平滑	每个用户占用内存
滑动窗口	精确	内存消耗大
固定窗口	简单	存在边界峰值

令牌桶 (Node.js)

class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;
    this.tokens = capacity;
    this.refillRate = refillRate; // tokens per second
    this.lastRefill = Date.now();
  }

  consume() {
    this.refill();
    if (this.tokens >= 1) {
      this.tokens--;
      return true;
    }
    return false;
  }

  refill() {
    const now = Date.now();
    const elapsed = (now - this.lastRefill) / 1000;
    this.tokens = Math.min(this.capacity, this.tokens + elapsed * this.refillRate);
    this.lastRefill = now;
  }
}

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

层级	请求数/小时
免费版	100
专业版	1,000
企业版	10,000

🇺🇸English

API Rate Limiting

Protect APIs from abuse using rate limiting algorithms with per-user and per-endpoint strategies.

Algorithms

Algorithm	Pros	Cons
Token Bucket	Handles bursts, smooth	Memory per user
Sliding Window	Accurate	Memory intensive
Fixed Window	Simple	Boundary spikes

Token Bucket (Node.js)

class TokenBucket {
  constructor(capacity, refillRate) {
    this.capacity = capacity;
    this.tokens = capacity;
    this.refillRate = refillRate; // tokens per second
    this.lastRefill = Date.now();
  }

  consume() {
    this.refill();
    if (this.tokens >= 1) {
      this.tokens--;
      return true;
    }
    return false;
  }

  refill() {
    const now = Date.now();
    const elapsed = (now - this.lastRefill) / 1000;
    this.tokens = Math.min(this.capacity, this.tokens + elapsed * this.refillRate);
    this.lastRefill = now;
  }
}

Express Middleware

const rateLimit = require('express-rate-limit');

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100,
  standardHeaders: true,
  message: { error: 'Too many requests, try again later' }
});

app.use('/api/', limiter);

Response Headers

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 45
X-RateLimit-Reset: 1705320000
Retry-After: 60

Tiered Limits

Tier	Requests/Hour
Free	100
Pro	1,000
Enterprise	10,000

Best Practices

Use Redis for distributed rate limiting
Include proper headers in responses
Return 429 status with Retry-After
Implement tiered limits for different plans
Monitor rate limit metrics
Test under load

Weekly Installs

Repository

secondsky/claude-skills

GitHub Stars

First Seen

Jan 22, 2026

Security Audits

Gen Agent Trust HubFail SocketPass SnykPass

Installed on

claude-code60

gemini-cli55

codex54

opencode52

github-copilot51

cursor51