lamassu/lamassu-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WIP; rate limiting

Browse source
This commit is contained in:
Josh Harvey 2016-12-21 17:58:39 +02:00
parent 199a2ea356
commit d27ff64a74
1 changed files with 10 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

22
bin/lamassu-admin-server
View file

@ -13,7 +13,6 @@ const argv = require('minimist')(process.argv.slice(2))
const got = require('got') const got = require('got')
const morgan = require('morgan') const morgan = require('morgan')
const helmet = require('helmet') const helmet = require('helmet')
const RateLimit = require('express-rate-limit')
const accounts = require('../lib/admin/accounts') const accounts = require('../lib/admin/accounts')
const machines = require('../lib/admin/machines') const machines = require('../lib/admin/machines')
@ -56,19 +55,18 @@ function dbNotify () {
const skip = (req, res) => req.path === '/api/status/' && res.statusCode === 200 const skip = (req, res) => req.path === '/api/status/' && res.statusCode === 200
const limiter = new RateLimit({ // Note: no rate limiting applied since that would allow an attacker to
windowMs: T.minute, // easily DDoS by just hitting the aggregate rate limit. We assume the
max: 120, // attacker has unlimited unique IP addresses.
delayMs: 0, //
delayAfter: 0, // The best we can do at the application level is to make the authentication
keyGenerator: () => 'everybody' // lookup very fast. There will only be a few users at most, so it's not a problem
}) // to keep them in memory, but we need to update right after a new one is added.
// For now, we believe that probability of sustained DDoS by saturating our ability to
// fetch from the DB is pretty low.
app.use(limiter)
app.use(morgan('dev', {skip})) app.use(morgan('dev', {skip}))
app.use(helmet({ app.use(helmet({noCache: true}))
noCache: true
}))
app.use(cookieParser()) app.use(cookieParser())
app.use(register) app.use(register)
app.use(authenticate) app.use(authenticate)