From 88aa7aad4c3f8dd105a795e5f10fe0dfe43b3920 Mon Sep 17 00:00:00 2001 From: Jackson Harper Date: Thu, 11 May 2023 13:23:43 +0800 Subject: [PATCH 1/4] Reduce the rate limit for unauthenticated users --- packages/api/src/server.ts | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/packages/api/src/server.ts b/packages/api/src/server.ts index 43a3eed3e..62c7655b7 100755 --- a/packages/api/src/server.ts +++ b/packages/api/src/server.ts @@ -50,6 +50,7 @@ import { userRouter } from './routers/user_router' import { sentryConfig } from './sentry' import { corsConfig } from './utils/corsConfig' import { buildLogger, buildLoggerTransport } from './utils/logger' +import { getClaimsByToken } from './utils/auth' const PORT = process.env.PORT || 4000 @@ -100,7 +101,13 @@ export const createApp = (): { if (!env.dev.isLocal) { const apiLimiter = rateLimit({ windowMs: 60 * 1000, // 1 minute - max: 50, // Limit each IP to 10 requests per `window` (here, per minute) + max: (req) => { + // 50 RPM for an authenticated request, 5 for a non-authenticated request + const token = getClaimsByToken( + req.header('authorization') ?? req.cookies['auth'] + ) + return !!token ? 50 : 5 + }, standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers legacyHeaders: false, // Disable the `X-RateLimit-*` headers keyGenerator: (req) => { From 8d9f54c62cd5c46c2b5f79dd2a5b9ea42b688c68 Mon Sep 17 00:00:00 2001 From: Jackson Harper Date: Thu, 11 May 2023 13:36:27 +0800 Subject: [PATCH 2/4] Fix linting --- packages/api/src/server.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/api/src/server.ts b/packages/api/src/server.ts index 62c7655b7..3b7be7b93 100755 --- a/packages/api/src/server.ts +++ b/packages/api/src/server.ts @@ -104,6 +104,7 @@ export const createApp = (): { max: (req) => { // 50 RPM for an authenticated request, 5 for a non-authenticated request const token = getClaimsByToken( + // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access req.header('authorization') ?? req.cookies['auth'] ) return !!token ? 50 : 5 From c49ca0149fb0e49ebc061724f327192c98eb3b11 Mon Sep 17 00:00:00 2001 From: Jackson Harper Date: Fri, 12 May 2023 17:11:20 +0800 Subject: [PATCH 3/4] Set max to 10/minute for unauthenticated requests --- packages/api/src/server.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/api/src/server.ts b/packages/api/src/server.ts index 3b7be7b93..7d3be8bfb 100755 --- a/packages/api/src/server.ts +++ b/packages/api/src/server.ts @@ -107,7 +107,7 @@ export const createApp = (): { // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access req.header('authorization') ?? req.cookies['auth'] ) - return !!token ? 50 : 5 + return !!token ? 50 : 10 }, standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers legacyHeaders: false, // Disable the `X-RateLimit-*` headers From 1d37f04808c505df0d68ee34f95ffaaac1d232ba Mon Sep 17 00:00:00 2001 From: Jackson Harper Date: Tue, 16 May 2023 17:14:38 +0800 Subject: [PATCH 4/4] Properly call getClaimsByToken --- packages/api/src/server.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/api/src/server.ts b/packages/api/src/server.ts index 7d3be8bfb..b1aeb91f6 100755 --- a/packages/api/src/server.ts +++ b/packages/api/src/server.ts @@ -101,13 +101,13 @@ export const createApp = (): { if (!env.dev.isLocal) { const apiLimiter = rateLimit({ windowMs: 60 * 1000, // 1 minute - max: (req) => { + max: async (req) => { // 50 RPM for an authenticated request, 5 for a non-authenticated request - const token = getClaimsByToken( + const token = await getClaimsByToken( // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access req.header('authorization') ?? req.cookies['auth'] ) - return !!token ? 50 : 10 + return token ? 50 : 10 }, standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers legacyHeaders: false, // Disable the `X-RateLimit-*` headers