prehistoric-systems/omnivore
1
0
Fork 0
mirror of https://github.com/omnivore-app/omnivore.git synced 2026-03-11 08:54:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #2183 from omnivore-app/fix/unauthed-rate-limit

Browse source 
Reduce the rate limit for unauthenticated users
This commit is contained in:
Jackson Harper 2023-05-18 15:15:18 +08:00 committed by GitHub
commit 058ccf3006
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
packages/api/src/server.ts
View file

@ -50,6 +50,7 @@ import { userRouter } from './routers/user_router'
import { sentryConfig } from './sentry'
import { corsConfig } from './utils/corsConfig'
import { buildLogger, buildLoggerTransport } from './utils/logger'
import { getClaimsByToken } from './utils/auth'
const PORT = process.env.PORT || 4000
@ -100,7 +101,14 @@ export const createApp = (): {
if (!env.dev.isLocal) {
const apiLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute
max: 50, // Limit each IP to 10 requests per `window` (here, per minute)
max: async (req) => {
// 50 RPM for an authenticated request, 5 for a non-authenticated request
const token = await getClaimsByToken(
// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
req.header('authorization') ?? req.cookies['auth']
)
return token ? 50 : 10
},
standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
legacyHeaders: false, // Disable the `X-RateLimit-*` headers
keyGenerator: (req) => {