feat(rate-limit): add more config options

Allow the admin to specify the rate-limits for user signup / login
Allow the admin to specify if Cloudflare specific rate-limit functionality should be used or not

Signed-off-by: Philip Molares <philip.molares@udo.edu>

lib/config/default.js

@@ -30,6 +30,8 @@ module.exports = {
     allowPDFEmbed: true
   },
   rateLimitNewNotes: 20,
+  rateLimitUser: 10,
+  rateLimitUsingCloudflare: false,
   cookiePolicy: 'lax',
   protocolUseSSL: false,
   // permissions

lib/config/environment.js

@@ -27,6 +27,8 @@ module.exports = {
     allowPDFEmbed: toBooleanConfig(process.env.CMD_CSP_ALLOW_PDF_EMBED)
   },
   rateLimitNewNotes: toIntegerConfig(process.env.CMD_RATE_LIMIT_NEW_NOTES),
+  rateLimitUser: toIntegerConfig(process.env.CMD_RATE_LIMIT_USER),
+  rateLimitUsingCloudflare: toBooleanConfig(process.env.CMD_RATE_LIMIT_USING_CLOUDFLARE),
   cookiePolicy: process.env.CMD_COOKIE_POLICY,
   protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL),
   allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN),

lib/web/middleware/rateLimit.js

@@ -8,13 +8,16 @@ const determineKey = (req) => {
   if (req.user) {
     return req.user.id
   }
-  return ipKeyGenerator(req.header('cf-connecting-ip') || req.ip)
+  if (config.rateLimitUsingCloudflare) {
+    return ipKeyGenerator(req.header('cf-connecting-ip') || req.ip)
+  }
+  return ipKeyGenerator(req.ip)
 }
 
 // limits requests to user endpoints (login, signup) to 10 requests per 5 minutes
 const userEndpoints = rateLimit({
   windowMs: 5 * 60 * 1000,
-  limit: 10,
+  limit: config.rateLimitUser,
   keyGenerator: determineKey,
   handler: (req, res) => errors.errorTooManyRequests(res)
 })