# HttpProtect class · @imqueue/http-protect

Source: https://imqueue.org/api/http-protect/latest/http-protect.httpprotect/
Published: 2026-08-01
Author: @imqueue maintainers (https://github.com/imqueue)
Package: @imqueue/http-protect 3.0.1 — generated reference, not hand-written

Per-IP request counting, rate limiting and banning for an express-like server.

**Signature:**

```typescript
export default class HttpProtect 
```

## Remarks

Counters and the block list live in Redis, so several processes behind a load balancer share one view of a client. `Networks` from `@imqueue/net` does the CIDR matching for [HttpProtect.safeNetworks](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.safenetworks/).

Constructing one opens a Redis connection unless [HttpProtectOptions.redis](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.redis/) supplies a client, and reads every threshold once — from the options, then from the environment. Changing an environment variable afterwards has no effect on a live instance.

The thresholds are not a rate. See [HttpProtect.ttl](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.ttl/) for what the counter actually measures, and [HttpProtectOptions.banLimit](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.banlimit/) for how long a ban lasts, before putting this in front of real traffic.

## Constructors


| Constructor | Modifiers | Description |
| --- | --- | --- |
| [(constructor)(options)](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect._constructor_/) |  | Resolves every threshold, parses the exempt networks and connects to Redis. |


## Properties


| Property | Modifiers | Type | Description |
| --- | --- | --- | --- |
| [banLimit](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.banlimit/) | `readonly` | number | The resolved ban threshold, from [HttpProtectOptions.banLimit](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.banlimit/), `HTTP_PROTECT_BAN_LIMIT`, or 1000. |
| [blockListKey](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.blocklistkey/) | `readonly` | string | The Redis key of the block-list set, `<prefix>:block-list`. |
| [getClientIp](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.getclientip/) | `readonly` | (req: Request) => string \| null | Resolves the client IP for a request — `request-ip`'s `getClientIp` unless [HttpProtectOptions.getClientIp](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.getclientip/) replaced it. |
| [maxRequests](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.maxrequests/) | `readonly` | number | The resolved 429 threshold, from [HttpProtectOptions.maxRequests](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.maxrequests/), `HTTP_PROTECT_MAX_REQUESTS`, or 200. |
| [prefix](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.prefix/) | `readonly` | string | The resolved Redis key prefix, from [HttpProtectOptions.redisPrefix](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.redisprefix/). |
| [safeNetworks](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.safenetworks/) | `readonly` | Networks | The parsed exempt networks, from [HttpProtectOptions.safeNetworks](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.safenetworks/). |
| [ttl](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.ttl/) | `readonly` | number | The resolved idle timeout in seconds, from [HttpProtectOptions.ttl](https://imqueue.org/api/http-protect/latest/http-protect.httpprotectoptions.ttl/), `HTTP_PROTECT_TTL`, or 10. |


## Methods


| Method | Modifiers | Description |
| --- | --- | --- |
| [bannedNetworks()](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.bannednetworks/) |  | The current block list, as a `Networks` object. |
| [connect(options)](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.connect/) |  | Opens a Redis connection and adopts it as this instance's client. |
| [destroy()](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.destroy/) |  | Disconnects the Redis client and drops it. |
| [isBanned(ip)](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.isbanned/) |  | Whether an address is currently on the block list. |
| [isLimited(ip)](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.islimited/) |  | Whether an address is currently over the 429 threshold. |
| [jsonMiddleware()](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.jsonmiddleware/) |  | A middleware that rejects with a JSON error body. |
| [middleware()](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.middleware/) |  | A middleware that rejects with a bare status code and no body. |
| [textMiddleware()](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.textmiddleware/) |  | A middleware that rejects with `text/plain`. |
| [verify(req)](https://imqueue.org/api/http-protect/latest/http-protect.httpprotect.verify/) |  | Counts a request against its client IP and decides whether to serve it. |