feat(rate-limit): add more config options

Allow the admin to specify the rate-limits for user signup / login
Allow the admin to specify if Cloudflare specific rate-limit functionality should be used or not

Signed-off-by: Philip Molares <philip.molares@udo.edu>

docs/content/configuration.md

@@ -89,7 +89,7 @@ these are rarely used for various reasons.
 ## Web security aspects
 
 | config file                   | environment                       | **default** and example value                                                             | description                                                                                                                                                               |
-|-------------------------------|--------------------------------|-------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|-------------------------------|-----------------------------------|-------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `hsts`                        |                                   | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year)                          |
 |                               | `CMD_HSTS_ENABLE`                 | **`true`** or `false`                                                                     | set to enable [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) if HTTPS is also enabled (default is ` true`)                                          |
 |                               | `CMD_HSTS_INCLUDE_SUBDOMAINS`     | **`true`** or `false`                                                                     | set to include subdomains in HSTS (default is `false`)                                                                                                                    |
@@ -107,6 +107,8 @@ these are rarely used for various reasons.
 | `csp.allowPDFEmbed`           | `CMD_CSP_ALLOW_PDF_EMBED`         | **`true`** or `false`                                                                     | Disable to disallow embedding PDFs. We recommend disabling this option, as it increases the attack surface of XSS attacks.                                                |
 | `cookiePolicy`                | `CMD_COOKIE_POLICY`               | **`lax`**, `strict` or `none`                                                             | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor.                           | 
 | `rateLimitNewNotes`           | `CMD_RATE_LIMIT_NEW_NOTES`        | **`20`**, `0` or any positive number                                                      | Sets the maximum amount of new note creations per 5-minute window per user. Can be disabled by setting to `0`.                                                            |
+| `rateLimitUser`               | `CMD_RATE_LIMIT_USER`             | **`10`**, `0` or any positive number                                                      | Sets the maximum amount of user auth interactions (login, signup) per 5-minute window per user. Can be disabled by setting to `0`.                                        |
+| `rateLimitUsingCloudflare`    | `CMD_RATE_LIMIT_USING_CLOUDFLARE` | **`false`** or `true`                                                                     | Activate specialy cloudflare ip handling. If you use cloudflare for your instance you want this to be true.                                                               |
 
 ## Privacy and External Requests
 

lib/config/default.js

@@ -30,6 +30,8 @@ module.exports = {
     allowPDFEmbed: true
   },
   rateLimitNewNotes: 20,
+  rateLimitUser: 10,
+  rateLimitUsingCloudflare: false,
   cookiePolicy: 'lax',
   protocolUseSSL: false,
   // permissions

lib/config/environment.js

@@ -27,6 +27,8 @@ module.exports = {
     allowPDFEmbed: toBooleanConfig(process.env.CMD_CSP_ALLOW_PDF_EMBED)
   },
   rateLimitNewNotes: toIntegerConfig(process.env.CMD_RATE_LIMIT_NEW_NOTES),
+  rateLimitUser: toIntegerConfig(process.env.CMD_RATE_LIMIT_USER),
+  rateLimitUsingCloudflare: toBooleanConfig(process.env.CMD_RATE_LIMIT_USING_CLOUDFLARE),
   cookiePolicy: process.env.CMD_COOKIE_POLICY,
   protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL),
   allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN),

lib/web/middleware/rateLimit.js

@@ -8,13 +8,16 @@ const determineKey = (req) => {
   if (req.user) {
     return req.user.id
   }
+  if (config.rateLimitUsingCloudflare) {
     return ipKeyGenerator(req.header('cf-connecting-ip') || req.ip)
+  }
+  return ipKeyGenerator(req.ip)
 }
 
 // limits requests to user endpoints (login, signup) to 10 requests per 5 minutes
 const userEndpoints = rateLimit({
   windowMs: 5 * 60 * 1000,
-  limit: 10,
+  limit: config.rateLimitUser,
   keyGenerator: determineKey,
   handler: (req, res) => errors.errorTooManyRequests(res)
 })

public/docs/release-notes.md

@@ -6,6 +6,8 @@
 
 - Added a warning page when clicking external links
 - Improve the config.json.example file, which is used by `bin/setup`
+- Allow configuration of login / signup rate-limits
+- Allow configuration of Cloudflare usage in regards rate-limits
 
 ## <i class="fa fa-tag"></i> 1.10.8 <i class="fa fa-calendar-o"></i> 2026-04-15