From c9ea622461cadd7be4588e5bfe44823814caa5fd Mon Sep 17 00:00:00 2001
From: Hongbo Wu <hongbo@omnivore.app>
Date: Tue, 25 Oct 2022 12:42:32 +0800
Subject: [PATCH] Use auth token to identify client request in rate limiter

---
 packages/api/src/server.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/api/src/server.ts b/packages/api/src/server.ts
index 2efb4e765..e5c4dfc56 100755
--- a/packages/api/src/server.ts
+++ b/packages/api/src/server.ts
@@ -94,12 +94,20 @@ export const createApp = (): {
   app.use(json({ limit: '100mb' }))
   app.use(urlencoded({ limit: '100mb', extended: true }))
 
-  if (!env.dev.isLocal) {
+  if (env.dev.isLocal) {
     const apiLimiter = rateLimit({
       windowMs: 60 * 1000, // 1 minute
       max: 50, // Limit each IP to 10 requests per `window` (here, per minute)
       standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
       legacyHeaders: false, // Disable the `X-RateLimit-*` headers
+      keyGenerator: (req) => {
+        return (
+          req.header('authorization') ||
+          // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+          (req.cookies['auth'] as string) ||
+          req.ip
+        )
+      },
     })
     // Apply the rate limiting middleware to API calls only
     app.use('/api/', apiLimiter)