Kai/habitica
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve rate limiting (#15272)

Browse Source 
* Improve rate limiting

* make rate limiter config names more consistent

* fix tests and add new one

* correct math
This commit is contained in:
Phillip Thelen
2024-08-06 19:45:27 +02:00
parent 6d7467ccaf
commit a7b9a78aa4
2 changed files with 64 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
website/server/middlewares/rateLimiter.js
+10 -1
View File
@@ -22,6 +22,8 @@ const REDIS_HOST = nconf.get('REDIS_HOST');
const REDIS_PASSWORD = nconf.get('REDIS_PASSWORD');
const REDIS_PORT = nconf.get('REDIS_PORT');
const LIVELINESS_PROBE_KEY = nconf.get('LIVELINESS_PROBE_KEY');
const REGISTRATION_COST = nconf.get('RATE_LIMITER_REGISTRATION_COST') || 5;
const IP_RATE_LIMIT_COST = nconf.get('RATE_LIMITER_IP_COST') || 5;
let redisClient;
let rateLimiter;
@@ -76,7 +78,14 @@ export default function rateLimiterMiddleware (req, res, next) {
const userId = req.header('x-api-user');
return rateLimiter.consume(userId || req.ip)
let cost = 1;
if (req.path === '/api/v4/user/auth/local/register' || req.path === '/api/v3/user/auth/local/register') {
cost = REGISTRATION_COST;
} else if (!userId) {
cost = IP_RATE_LIMIT_COST;
}
return rateLimiter.consume(userId || req.ip, cost)
.then(rateLimiterRes => {
setResponseHeaders(res, rateLimiterRes);
return next();