Add rate-limiting?

[eddiejibson]

Hi,

Thought maybe adding rate-limiting to this project might be a good idea...

Might be quite difficult but I have released a library which may be of help? https://github.com/eddiejibson/limitrr

[eddiejibson]

I've gone ahead and added a simple ExpressJS example: https://limitrr.js.org/#/quickstart?id=simple-expressjs-example
If this package is useful to you, please try and give it a star on it's GitHub repository. Helps us a lot in getting noticed.
Note, however, that there are many examples of each function within their respective pages. Should be quite easy to implement. Let me know if you have any more questions or concerns.

[fega]

@eddiejibson Hello eddie, yes I think that your module could be useful for that.

btw, you really improved the first example, but I think it could even better, I'll try to send you a pr when i got some time.

[eddiejibson]

That's good to hear, let me know if you have any issues integrating it. Alright, great. Sounds good. I'll look forward to seeing it 👍

[SorinGFS]

Hi,
This is a nice project, I see a lot of potential here!
For rate limit, as for slow down the spammers you can use:

In app file:

const rateLimit = require('./middlewares/ratelimit');
const slowDown = require('./middlewares/slowdown');
...
app.use(rateLimit.ip, slowDown.ip, rateLimit.route, slowDown.route);
...

... and in the ./middlewares/ratelimit put:

'use strict';
const rateLimit = require('express-rate-limit');

module.exports = {
    ip: rateLimit({
        windowMs: 1 * 60 * 1000, // 1 minute
        max: 1000, // limit each IP to max requests per windowMs // Default 5. Set 0 to disable
        headers: false, // Default true
        onLimitReached: function (req, res, options) {},
        keyGenerator: function (req /*, res*/) {
            return req.ip; // this can be modified for more granular control
        },
        skip: function (/*req, res*/) {
            return process.env.RATE_LIMIT_IP_ENABLED == 'true' ? false : true;
        },
    }),
    route: rateLimit({
        windowMs: 1 * 60 * 1000, // 1 minute
        max: 5, // limit each IP to max requests per windowMs // Default 5. Set 0 to disable
        headers: false, // Default true
        onLimitReached: function (req, res, options) {},
        keyGenerator: function (req /*, res*/) {
            return req.ip + ':' + req.path; // this can be modified for more granular control
        },
        message: 'Too many requests from this location.',
        skip: function (/*req, res*/) {
            return process.env.RATE_LIMIT_ROUTE_ENABLED == 'true' ? false : true;
        },
    }),
};
console.log('RATE_LIMIT_IP_ENABLED = ' + process.env.RATE_LIMIT_IP_ENABLED);
console.log('RATE_LIMIT_ROUTE_ENABLED = ' + process.env.RATE_LIMIT_ROUTE_ENABLED);

and in ./middlewares/slowdown put:

'use strict';
const slowDown = require('express-slow-down');

module.exports = {
    ip: slowDown({
        windowMs: 2 * 60 * 1000, // 2 minutes
        delayAfter: 500, // allow 500requests per 2 minutes, then...
        delayMs: 10, // begin adding 10ms of delay per request above delayAfter:
        onLimitReached: function (req, res, options) {},
        keyGenerator: function (req /*, res*/) {
            return req.ip; // this can be modified for more granular control
        },
        skip: function (/*req, res*/) {
            return process.env.SLOW_DOWN_IP_ENABLED == 'true' ? false : true;
        },
    }),
    route: slowDown({
        windowMs: 2 * 60 * 1000, // 2 minutes
        delayAfter: 1, 
        delayMs: 1400, // begin adding 1400ms of delay per request above delayAfter:
        onLimitReached: function (req, res, options) {},
        keyGenerator: function (req /*, res*/) {
            return req.ip + ':' + req.path; // this can be modified for more granular control
        },
        skip: function (/*req, res*/) {
            return process.env.SLOW_DOWN_ROUTE_ENABLED == 'true' ? false : true;
        },
    }),
};
console.log('SLOW_DOWN_IP_ENABLED = ' + process.env.SLOW_DOWN_IP_ENABLED);
console.log('SLOW_DOWN_ROUTE_ENABLED = ' + process.env.SLOW_DOWN_ROUTE_ENABLED);

In env file the specified settings must be present, or you need to remove the conditionality.

That's all, this setup allows you to have a nice control on incomming connections: a lax setting for connections from the same ip (allowing a generous number of static files), and restricting the connections for the same rute and same ip.