8891d75baa
Allow the admin to specify the rate-limits for user signup / login Allow the admin to specify if Cloudflare specific rate-limit functionality should be used or not Signed-off-by: Philip Molares <philip.molares@udo.edu>
37 lines
979 B
JavaScript
37 lines
979 B
JavaScript
'use strict'
|
|
|
|
const { rateLimit, ipKeyGenerator } = require('express-rate-limit')
|
|
const errors = require('../../errors')
|
|
const config = require('../../config')
|
|
|
|
const determineKey = (req) => {
|
|
if (req.user) {
|
|
return req.user.id
|
|
}
|
|
if (config.rateLimitUsingCloudflare) {
|
|
return ipKeyGenerator(req.header('cf-connecting-ip') || req.ip)
|
|
}
|
|
return ipKeyGenerator(req.ip)
|
|
}
|
|
|
|
// limits requests to user endpoints (login, signup) to 10 requests per 5 minutes
|
|
const userEndpoints = rateLimit({
|
|
windowMs: 5 * 60 * 1000,
|
|
limit: config.rateLimitUser,
|
|
keyGenerator: determineKey,
|
|
handler: (req, res) => errors.errorTooManyRequests(res)
|
|
})
|
|
|
|
// limits the amount of requests to the new note endpoint per 5 minutes based on configuration
|
|
const newNotes = rateLimit({
|
|
windowMs: 5 * 60 * 1000,
|
|
limit: config.rateLimitNewNotes,
|
|
keyGenerator: determineKey,
|
|
handler: (req, res) => errors.errorTooManyRequests(res)
|
|
})
|
|
|
|
module.exports = {
|
|
userEndpoints,
|
|
newNotes
|
|
}
|