feat: add global and session rate limit

server/src/api/routes/sessions.js

@@ -1,10 +1,11 @@
 import { Router } from 'express'
 import * as sessionController from '../controllers/sessionController.js'
+import sessionRateLimit from '../../middleware/sessionRateLimit.js'
 
 const router = Router()
 
 router.get('/', sessionController.getSessionList)
-router.post('/', sessionController.createSession)
+router.post('/', sessionRateLimit, sessionController.createSession)
 router.post('/active', sessionController.getActiveSession)
 router.get('/:id', sessionController.getSessionById)
 router.delete('/:id', sessionController.deleteSessionById)

server/src/index.js

@@ -12,6 +12,7 @@ import apiRouter from './api/routes/index.js'
 import loadAndUpdateQuests from './utils/quest.js'
 import config from './config.js'
 import errorHandler from './middleware/error.js'
+import globalRateLimit from './middleware/globalRateLimit.js'
 import sessionMiddleware from './middleware/session.js'
 import expiryRemovalScheduler from './containers/expiryChecker.js'
 import { createTestUser } from './utils/auth.js'
@@ -37,6 +38,7 @@ async function main() {
   const server = http.createServer(app)
   socketServer(server)
   app.use(errorHandler)
+  app.use(globalRateLimit)
   app.use(sessionMiddleware)
   app.use(passport.session())
   app.use(

server/src/middleware/globalRateLimit.js

@@ -0,0 +1,6 @@
+import { rateLimit } from 'express-rate-limit'
+
+export default rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 20,
+})

server/src/middleware/sessionRateLimit.js

@@ -0,0 +1,9 @@
+import { rateLimit } from 'express-rate-limit'
+
+export default rateLimit({
+  windowMs: 10 * 1000,
+  max: 1,
+  keyGenerator: (req) => {
+    return req.user ? req.user._id : req.ip
+  },
+})