WIP

lib/routes.js

@@ -2,6 +2,7 @@
 
 const morgan = require('morgan')
 const helmet = require('helmet')
+const RateLimit = require('express-rate-limit')
 const bodyParser = require('body-parser')
 const BigNumber = require('bignumber.js')
 const _ = require('lodash/fp')
@@ -16,6 +17,7 @@ const settingsLoader = require('./settings-loader')
 const plugins = require('./plugins')
 const helpers = require('./route-helpers')
 const poller = require('./poller')
+const T = require('./time')
 
 module.exports = {init}
 
@@ -347,6 +349,14 @@ function init (opts) {
     '/phone_code'
   ]
 
+  const limiter = new RateLimit({
+    windowMs: T.minute,
+    max: 10,
+    delayMs: 0,
+    delayAfter: 0,
+    keyGenerator: () => 'everybody'
+  })
+
   app.use(morgan('dev', {skip}))
   app.use(helmet())
   app.use(populateDeviceId)
@@ -355,8 +365,8 @@ function init (opts) {
   app.use(filterOldRequests)
   app.post('*', cacheAction)
 
-  app.post('/pair', pair)
-  app.get('/ca', ca)
+  app.post('/pair', limiter, pair)
+  app.get('/ca', limiter, ca)
 
   app.get('/poll', authMiddleware, poll)