feat: add global and session rate limit

server/package.json

@@ -11,13 +11,14 @@
   },
   "dependencies": {
     "@linux-odyssey/file-graph": "*",
-    "@linux-odyssey/utils": "*",
     "@linux-odyssey/models": "*",
+    "@linux-odyssey/utils": "*",
     "bcrypt": "^5.1.1",
     "commander": "^11.0.0",
     "connect-mongo": "^5.0.0",
     "dockerode": "^3.3.5",
     "express": "^4.18.2",
+    "express-rate-limit": "^7.1.3",
     "express-session": "^1.17.3",
     "jsonwebtoken": "^9.0.1",
     "minimist": "^1.2.8",

server/src/api/routes/sessions.js

@@ -1,10 +1,11 @@
 import { Router } from 'express'
 import * as sessionController from '../controllers/sessionController.js'
+import sessionRateLimit from '../../middleware/sessionRateLimit.js'
 
 const router = Router()
 
 router.get('/', sessionController.getSessionList)
-router.post('/', sessionController.createSession)
+router.post('/', sessionRateLimit, sessionController.createSession)
 router.post('/active', sessionController.getActiveSession)
 router.get('/:id', sessionController.getSessionById)
 router.delete('/:id', sessionController.deleteSessionById)

server/src/index.js

@@ -12,6 +12,7 @@ import apiRouter from './api/routes/index.js'
 import loadAndUpdateQuests from './utils/quest.js'
 import config from './config.js'
 import errorHandler from './middleware/error.js'
+import globalRateLimit from './middleware/globalRateLimit.js'
 import sessionMiddleware from './middleware/session.js'
 import expiryRemovalScheduler from './containers/expiryChecker.js'
 import { createTestUser } from './utils/auth.js'
@@ -37,6 +38,7 @@ async function main() {
   const server = http.createServer(app)
   socketServer(server)
   app.use(errorHandler)
+  app.use(globalRateLimit)
   app.use(sessionMiddleware)
   app.use(passport.session())
   app.use(

server/src/middleware/globalRateLimit.js

@@ -0,0 +1,6 @@
+import { rateLimit } from 'express-rate-limit'
+
+export default rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 20,
+})

server/src/middleware/sessionRateLimit.js

@@ -0,0 +1,9 @@
+import { rateLimit } from 'express-rate-limit'
+
+export default rateLimit({
+  windowMs: 10 * 1000,
+  max: 1,
+  keyGenerator: (req) => {
+    return req.user ? req.user._id : req.ip
+  },
+})

yarn.lock

@@ -2848,6 +2848,11 @@ express-handlebars@^7.1.2:
     graceful-fs "^4.2.11"
     handlebars "^4.7.8"
 
+express-rate-limit@^7.1.3:
+  version "7.1.3"
+  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-7.1.3.tgz#0eae6c7733316f3d9403a71ad488e31e94ca0aa4"
+  integrity sha512-BDes6WeNYSGRRGQU8QDNwUnwqaBro28HN/TTweM3RlxXRHDld8RLoH7tbfCxAc0hamQyn6aL0KrfR45+ZxknYg==
+
 express-session@^1.17.3:
   version "1.17.3"
   resolved "https://registry.yarnpkg.com/express-session/-/express-session-1.17.3.tgz#14b997a15ed43e5949cb1d073725675dd2777f36"