This doesn't work in real time. Coz , it doesn't seperate the requests for each user. If one user crossed the limit and other user it is showing the rate limiting error for the first-time.
That's most likely caused by your server setup. If your app is behind proxy or load balancer you can add app.set('trust proxy', true); You can add a middleware to console log the IP for debugging. Hopefully that will fix your issue
