Per-request cost

[drmrbrewer]

Description

First, thanks for this really useful module!

So far as I can tell, it's possible at present to set max, and each request will count as one towards that max quota.

I'd find it useful to have a definable function which can set a per-request 'cost', so that some requests count as 1 towards the quota, while others count as more, e.g. 2 or more.

Why

If a request is using more server resources (based on the options passed in) then it should deplete its allowed quota more quickly and be rate limited sooner.

Alternatives

Could add multiple different limiters, each with different criteria and different max, but this seems overkill when a simple cost function could be used.

[gamemaker1]

This sounds like a good idea! We could add a number/function option just like max called cost.

However, this will require us to make changes to the Store interface - increment and decrement will have to become incrementBy and decrementBy. Or we could just call increment and decrement multiple times.

What do you think @nfriedly?

Also, if we decide to implement this feature, @drmrbrewer would you like to make a PR for it?

[drmrbrewer]

I've just noticed that max can be a function, so this is useful in my context (e.g. max could be reduced if the request is more resource intensive than normal), but I still think that a separate cost number/function would also be useful for additional control.

[nfriedly]

You might want to try out https://www.npmjs.com/package/rate-limiter-flexible - it has a "points" concept that I believe matches what you're requesting - see https://github.com/animir/node-rate-limiter-flexible/wiki/API-methods#ratelimiterconsumekey-points--1-options--

[drmrbrewer]

@nfriedly thanks for the link, but I way prefer the relative simplicity of express-rate-limit, and a simple cost number/function would be a useful addition :-)