prehistoric-systems/omnivore
1
0
Fork 0
mirror of https://github.com/omnivore-app/omnivore.git synced 2026-03-11 08:54:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

create another rate limiter for auth api with 4 rpm

Browse source
This commit is contained in:
Hongbo Wu 2023-06-14 19:31:18 +08:00
parent fc08a434e1
commit 5d2ab3f554
1 changed files with 35 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

63
packages/api/src/server.ts
View file

@ -48,6 +48,7 @@ import { webhooksServiceRouter } from './routers/svc/webhooks'
import { textToSpeechRouter } from './routers/text_to_speech'
import { userRouter } from './routers/user_router'
import { sentryConfig } from './sentry'
import { getClaimsByToken } from './utils/auth'
import { corsConfig } from './utils/corsConfig'
import { buildLogger, buildLoggerTransport } from './utils/logger'
@ -97,32 +98,30 @@ export const createApp = (): {
app.use(json({ limit: '100mb' }))
app.use(urlencoded({ limit: '100mb', extended: true }))
if (!env.dev.isLocal) {
const apiLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute
max: 100,
// async (req) => {
// // 100 RPM for an authenticated request, 5 for a non-authenticated request
// // const token = await getClaimsByToken(
// // // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
// // req.header('authorization') ?? req.cookies['auth']
// // )
// return 100 // token ? 100 : 10
// },
standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
legacyHeaders: false, // Disable the `X-RateLimit-*` headers
keyGenerator: (req) => {
return (
req.header('authorization') ||
// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
(req.cookies['auth'] as string) ||
req.ip
)
},
})
// Apply the rate limiting middleware to API calls only
app.use('/api/', apiLimiter)
}
const apiLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute
max: async (req) => {
// 100 RPM for an authenticated request, 5 for a non-authenticated request
const token = await getClaimsByToken(
// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
req.header('authorization') ?? req.cookies['auth']
)
return token ? 100 : 5
},
keyGenerator: (req) => {
return (
req.header('authorization') ||
// eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
(req.cookies['auth'] as string) ||
req.ip
)
},
// skip preflight requests and test requests
skip: (req) => req.method === 'OPTIONS' || env.dev.isLocal,
})
// Apply the rate limiting middleware to API calls only
app.use('/api/', apiLimiter)
// set client info in the request context
app.use(httpContext.middleware)
@ -137,11 +136,19 @@ export const createApp = (): {
// respond healthy to auto-scaler.
app.get('/_ah/health', (req, res) => res.sendStatus(200))
app.use('/api/auth', authRouter())
// 5 RPM for auth requests
const authLimiter = rateLimit({
windowMs: 60 * 1000, // 1 minute
max: 5,
// skip preflight requests and test requests
skip: (req) => req.method === 'OPTIONS' || env.dev.isLocal,
})
app.use('/api/auth', authLimiter, authRouter())
app.use('/api/mobile-auth', authLimiter, mobileAuthRouter())
app.use('/api/page', pageRouter())
app.use('/api/user', userRouter())
app.use('/api/article', articleRouter())
app.use('/api/mobile-auth', mobileAuthRouter())
app.use('/api/text-to-speech', textToSpeechRouter())
app.use('/api/notification', notificationRouter())
app.use('/api/integration', integrationRouter())