sasjs/server
1
0
Fork 0
mirror of https://github.com/sasjs/server.git synced 2025-12-11 19:44:35 +00:00
Code Issues Projects Releases Wiki Activity

fix: use RateLimiterMemory instead of RateLimiterMongo

Browse Source
This commit is contained in:
Sabir Hassan
2023-04-27 15:06:24 +05:00
parent 70c3834022
commit 6a520f5b26
2 changed files with 10 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@@ -184,7 +184,7 @@ MAX_WRONG_ATTEMPTS_BY_IP_PER_DAY = <number> default: 100;
# After this, access is blocked for an hour # After this, access is blocked for an hour
# Store number for 90 days since first fail # Store number for 24 days since first fail
# Once a successful login is attempted, it resets # Once a successful login is attempted, it resets
MAX_CONSECUTIVE_FAILS_BY_USERNAME_AND_IP = <number> default: 10; MAX_CONSECUTIVE_FAILS_BY_USERNAME_AND_IP = <number> default: 10;

21
api/src/utils/rateLimiter.ts
View File

@@ -1,10 +1,9 @@
import mongoose from 'mongoose' import { RateLimiterMemory } from 'rate-limiter-flexible'
import { RateLimiterMongo } from 'rate-limiter-flexible'
export class RateLimiter { export class RateLimiter {
private static instance: RateLimiter private static instance: RateLimiter
private limiterSlowBruteByIP: RateLimiterMongo private limiterSlowBruteByIP: RateLimiterMemory
private limiterConsecutiveFailsByUsernameAndIP: RateLimiterMongo private limiterConsecutiveFailsByUsernameAndIP: RateLimiterMemory
private maxWrongAttemptsByIpPerDay: number private maxWrongAttemptsByIpPerDay: number
private maxConsecutiveFailsByUsernameAndIp: number private maxConsecutiveFailsByUsernameAndIp: number
@@ -19,19 +18,17 @@ export class RateLimiter {
MAX_CONSECUTIVE_FAILS_BY_USERNAME_AND_IP MAX_CONSECUTIVE_FAILS_BY_USERNAME_AND_IP
) )
this.limiterSlowBruteByIP = new RateLimiterMongo({ this.limiterSlowBruteByIP = new RateLimiterMemory({
storeClient: mongoose.connection,
keyPrefix: 'login_fail_ip_per_day', keyPrefix: 'login_fail_ip_per_day',
points: this.maxWrongAttemptsByIpPerDay, points: this.maxWrongAttemptsByIpPerDay,
duration: 60 * 60 * 24, duration: 60 * 60 * 24,
blockDuration: 60 * 60 * 24 // Block for 1 day blockDuration: 60 * 60 * 24 // Block for 1 day
}) })
this.limiterConsecutiveFailsByUsernameAndIP = new RateLimiterMongo({ this.limiterConsecutiveFailsByUsernameAndIP = new RateLimiterMemory({
storeClient: mongoose.connection,
keyPrefix: 'login_fail_consecutive_username_and_ip', keyPrefix: 'login_fail_consecutive_username_and_ip',
points: this.maxConsecutiveFailsByUsernameAndIp, points: this.maxConsecutiveFailsByUsernameAndIp,
duration: 60 * 60 * 24 * 90, // Store number for 90 days since first fail duration: 60 * 60 * 24 * 24, // Store number for 24 days since first fail
blockDuration: 60 * 60 // Block for 1 hour blockDuration: 60 * 60 // Block for 1 hour
}) })
} }
@@ -60,8 +57,7 @@ export class RateLimiter {
this.limiterConsecutiveFailsByUsernameAndIP.get(usernameIPkey) this.limiterConsecutiveFailsByUsernameAndIP.get(usernameIPkey)
]) ])
// NOTE: To make use of blockDuration option from RateLimiterMongo // NOTE: To make use of blockDuration option, comparison in both following if statements should have greater than symbol
// comparison in both following if statements should have greater than symbol
// otherwise, blockDuration option will not work // otherwise, blockDuration option will not work
// For more info see: https://github.com/animir/node-rate-limiter-flexible/wiki/Options#blockduration // For more info see: https://github.com/animir/node-rate-limiter-flexible/wiki/Options#blockduration
@@ -103,10 +99,11 @@ export class RateLimiter {
if (rlRejected instanceof Error) { if (rlRejected instanceof Error) {
throw rlRejected throw rlRejected
} else { } else {
// based upon the implementation of consume method of RateLimiterMongo // based upon the implementation of consume method of RateLimiterMemory
// we are sure that rlRejected will contain msBeforeNext // we are sure that rlRejected will contain msBeforeNext
// for further reference, // for further reference,
// see https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#login-endpoint-protection // see https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#login-endpoint-protection
// or see https://github.com/animir/node-rate-limiter-flexible#ratelimiterres-object
return Math.ceil(rlRejected.msBeforeNext / 1000) return Math.ceil(rlRejected.msBeforeNext / 1000)
} }
} }