Registry / security / express-brute-mongo

express-brute-mongo

JSON →
library1.0.0jsnpmunverified

MongoDB store adapter for express-brute, version 1.0.0. This package provides a persistent store for rate-limiting data using MongoDB. It is designed to work with the express-brute middleware in Express.js applications. The adapter uses an asynchronous function to provide a MongoDB collection reference. A key differentiator is its reliance on MongoDB TTL indexes for automatic expiration of rate-limit data. The package is stable but relies on the deprecated `mongodb` Node.js driver v2/3 style callbacks, not the newer async/await pattern. Expect minimal updates; it is in maintenance mode as express-brute itself is not actively developed.

securitydatabase
npm install express-brute-mongo
github ↗package ↗homepage ↗
INSTALL
IMPORT
SIG · EXPRESS-BRUTE-MONG
E
express-brute-mongo
securityjavascriptv1.0.0
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

MongoStore
✓ const MongoStore = require('express-brute-mongo');
✗ import MongoStore from 'express-brute-mongo';
This package uses CommonJS (require) and does not ship ESM. Using ES import syntax will fail.
MongoStore
✓ const MongoStore = require('express-brute-mongo');
✗ const { MongoStore } = require('express-brute-mongo');
The package exports a single constructor function directly, not as a named export. Destructuring will result in undefined.
MongoStore (instantiation)
✓ new MongoStore(function (ready) { ... });
✗ new MongoStore(); // Missing callback function
MongoStore constructor requires a callback function that receives a 'ready' callback. Omitting it will cause an error when express-brute tries to use the store.

Complete setup of express-brute with MongoDB store, including MongoDB connection and rate-limiting a POST route.

const ExpressBrute = require('express-brute'); const MongoStore = require('express-brute-mongo'); const MongoClient = require('mongodb').MongoClient; const store = new MongoStore(function (ready) { MongoClient.connect('mongodb://127.0.0.1:27017/test', { useNewUrlParser: true, useUnifiedTopology: true }, function(err, db) { if (err) { console.error('Failed to connect to MongoDB:', err); process.exit(1); } ready(db.collection('bruteforce-store')); }); }); const bruteforce = new ExpressBrute(store); const express = require('express'); const app = express(); app.post('/auth', bruteforce.prevent, function (req, res) { res.send('Success!'); } ); app.listen(3000, () => console.log('Server running on port 3000'));
Debug
Known issues
deprecatedMongoDB Node.js driver 3.x is deprecated; version 4.x+ uses Promise-based API.
fix
Use mongodb driver version ^3.7 or adapt to newer driver that supports callback style, or wrap with a callback-based function.
affects: all
gotchaMongoStore constructor requires a callback that calls the 'ready' function with a collection object. If the callback fails, express-brute may not start correctly.
fix
Ensure you call ready() with a MongoDB collection object (e.g., db.collection('name')). Do not call ready with a database handle.
affects: all
gotchaThe package does not handle TTL index creation automatically; you must manually ensure an index on 'expires' field with expireAfterSeconds: 0.
fix
Run this command in mongo shell: db.collection.createIndex({ expires: 1 }, { expireAfterSeconds: 0 });
affects: all
deprecatedexpress-brute is in maintenance mode and may not receive updates for Express 5 or newer Node.js versions.
fix
Consider using an alternative rate-limiting library like express-rate-limit with MongoDB via rate-limit-mongo.
affects: all
Errors
Common errors & fixes
TypeError: store.set is not a function
The store instance passed to ExpressBrute is not a valid store object (likely missing the callback or wrong collection).
fix
Ensure you pass a MongoStore instance that has been properly initialized with a callback that calls ready() with a collection.
MongoError: E11000 duplicate key error collection: test.bruteforce-store index: _id_ dup key: { _id: "..." }
The TTL index is not set, so documents accumulate and cause duplicate key errors when express-brute tries to insert a new record with the same _id.
fix
Create the TTL index: db.collection('bruteforce-store').createIndex({ expires: 1 }, { expireAfterSeconds: 0 });
TypeError: db.collection is not a function
You passed a database object ('db') to the ready callback instead of a collection object.
fix
Call ready(db.collection('bruteforce-store')) not ready(db).
Upgrade
Version history
1.0.0latest on npm
Audit
Dependencies
express-bruterequiredThis is a store adapter that must be used with express-brute, which provides the rate-limiting middleware and store interface.
mongodbrequiredThe package uses the native MongoDB driver to connect and interact with MongoDB. It expects a driver that supports callbacks.
Agent activity
17 hits · last 30 days
node
16
Amazon
1
Resources
githubhttps://github.com/auth0/express-brute-mongo ↗
packageexpress-brute-mongo ↗
homepagehttps://github.com/auth0/express-brute-mongo#readme ↗
express-brute-mongo — npm install express-brute-mongo · libregistry