From 88aa7aad4c3f8dd105a795e5f10fe0dfe43b3920 Mon Sep 17 00:00:00 2001
From: Jackson Harper <jacksonh@gmail.com>
Date: Thu, 11 May 2023 13:23:43 +0800
Subject: [PATCH] Reduce the rate limit for unauthenticated users

---
 packages/api/src/server.ts | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/packages/api/src/server.ts b/packages/api/src/server.ts
index 43a3eed3e..62c7655b7 100755
--- a/packages/api/src/server.ts
+++ b/packages/api/src/server.ts
@@ -50,6 +50,7 @@ import { userRouter } from './routers/user_router'
 import { sentryConfig } from './sentry'
 import { corsConfig } from './utils/corsConfig'
 import { buildLogger, buildLoggerTransport } from './utils/logger'
+import { getClaimsByToken } from './utils/auth'
 
 const PORT = process.env.PORT || 4000
 
@@ -100,7 +101,13 @@ export const createApp = (): {
   if (!env.dev.isLocal) {
     const apiLimiter = rateLimit({
       windowMs: 60 * 1000, // 1 minute
-      max: 50, // Limit each IP to 10 requests per `window` (here, per minute)
+      max: (req) => {
+        // 50 RPM for an authenticated request, 5 for a non-authenticated request
+        const token = getClaimsByToken(
+          req.header('authorization') ?? req.cookies['auth']
+        )
+        return !!token ? 50 : 5
+      },
       standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
       legacyHeaders: false, // Disable the `X-RateLimit-*` headers
       keyGenerator: (req) => {