WIP: Rate limiter

packages/base/express/rateLimit.js

@@ -0,0 +1,13 @@
+var RateLimit = require('express-rate-limit')
+
+module.exports = new RateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 10,
+  delayMs: 100,
+  onLimitReached (req, res, options) {
+    console.log(`rate limit / reached for ${req.user && req.user.id} ${req.ip} ${JSON.stringify(req.rateLimit)}`)
+  },
+  keyGenerator (req) {
+    return (req.user ? `${req.user.id}-${req.ip}` : req.ip)
+  }
+})

packages/base/package.json

@@ -37,6 +37,7 @@
     "d3-time-format": "^2.1.1",
     "export-files": "^2.1.1",
     "express": "^4.16.2",
+    "express-rate-limit": "^2.11.0",
     "graphql-redis-subscriptions": "^1.4.0",
     "graphql-subscriptions": "^0.5.6",
     "pogi": "^2.5.5",

packages/base/server.js

@@ -24,6 +24,7 @@ const {
 // middlewares
 const { express: { auth } } = require('@orbiting/backend-modules-auth')
 const requestLog = require('./express/requestLog')
+const rateLimit = require('./express/rateLimit')
 const graphql = require('./express/graphql')
 
 let pgdb
@@ -48,7 +49,7 @@ module.exports.run = (executableSchema, middlewares, t, signInHooks) => {
     engine.start()
   }
 
-  return PgDb.connect().then( async (_pgdb) => {
+  return PgDb.connect().then(async (_pgdb) => {
     pgdb = _pgdb
     server = express()
     httpServer = createServer(server)
@@ -71,6 +72,9 @@ module.exports.run = (executableSchema, middlewares, t, signInHooks) => {
       signInHooks
     })
 
+    // Rate Limiting middleware needs to be after auth to access user id
+    server.use(rateLimit)
+
     if (CORS_WHITELIST_URL) {
       const corsOptions = {
         origin: CORS_WHITELIST_URL.split(','),
@@ -82,7 +86,7 @@ module.exports.run = (executableSchema, middlewares, t, signInHooks) => {
 
     subscriptionServer = graphql(server, pgdb, httpServer, executableSchema, t)
 
-    for(let middleware of middlewares) {
+    for (let middleware of middlewares) {
       await middleware(server, pgdb, t)
     }
 

yarn.lock

@@ -1721,6 +1721,12 @@ export-files@^2.1.1:
   dependencies:
     lazy-cache "^1.0.3"
 
+express-rate-limit@^2.11.0:
+  version "2.11.0"
+  resolved "https://registry.yarnpkg.com/express-rate-limit/-/express-rate-limit-2.11.0.tgz#092122218c86eddb56fb350f431e522fb8024ea9"
+  dependencies:
+    defaults "^1.0.3"
+
 express-session@^1.15.6:
   version "1.15.6"
   resolved "https://registry.yarnpkg.com/express-session/-/express-session-1.15.6.tgz#47b4160c88f42ab70fe8a508e31cbff76757ab0a"