From 0a51c4f2180b1d4ea9d3e8f1f2a73695311f03f3 Mon Sep 17 00:00:00 2001 From: Maxime Cannoodt Date: Wed, 29 Jun 2022 22:32:18 +0200 Subject: [PATCH] rate limit env variable --- server/.env | 9 ++++++++- server/prisma/dev.db | Bin 815104 -> 815104 bytes server/server.ts | 5 ++--- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/server/.env b/server/.env index 42cc3fd..7e0a02e 100644 --- a/server/.env +++ b/server/.env @@ -6,6 +6,13 @@ ENVIRONMENT=dev PORT=8080 -CLEANUP_INTERVAL_SECONDS=60 + FRONTEND_URL="http://localhost:3000" DATABASE_URL="file:./dev.db" + +CLEANUP_INTERVAL_SECONDS=60 + +POST_LIMIT_WINDOW_SECONDS=3 # 3 seconds +POST_LIMIT=1 +# POST_LIMIT_WINDOW=86400 # 24 hours +# POST_LIMIT=50 diff --git a/server/prisma/dev.db b/server/prisma/dev.db index 0fc7f042d045bf1da1c84d38fd483a79b657981f..82933cbc6f7488187f0cdd7ad43ddc9c50e6c02a 100644 GIT binary patch delta 15143 zcmZ|0S;#bPnkLj`PuEOafAK4d^mKLibakJMofNTeppLQc`;w7)G8Oxt85xnW!jRPp z4h0@KBJ_bEeISkpBDMolj5_v-AakO~9H@xWsOX7GE6yN@;PW{;|KD1|8~J_7oy+^i z^Tc)E*AhSZBjhK4g!~IX`2Jt}gA&;O ze)W^T{MAps1CD-`~KLihd^Ebf5 zzyAa9@Q1(hdw=^cei!-0AAa@QzxStq{N2m1e1G`9{e9&7|HxN==d1tptH1Hpzx>r- z`sy!!#e(WT{p0Wct3Ugne*9hHd!Jwb#lP^KtS4X;W=a%>VXDF3Yw{}FtseT{{-#Rd z6{x~rsy#6;dA>Hk_5W0ngDh7VMyToeUY}!GkW4lH@S7^pw4e%qsm|H-AZj%G&Hual zfsq3rzkKokRbJ9ZhcBOLeBkWh?UM zuYapbcV9mFOLgh%c1jNH*S@LtT?T((6j`hHdKB<0-$?ui-;}#z{_@3Ns;_Z>4X*+D z)o-e8{^fj7U#cmIkL!WwfA*Vdy@6jEhQCyae#@%8&3@(YS6}6x!Z1O+!TI>hzdw8z z9Df=de+C@C432;BXTLvuFGqj&r~c@B|H^kizx`+a!Y}>OU-|y;e*gb>k-qc0fABls z`8U7w&*=a9-}*N~RGM=+>SE+_bC9l}i{xR28WriLgI0x?%A_?vR`K4q;vI@zJ((Ve zJ3ix*%C3i`D)6lM@3CD{jJJd2-h6ibHt2Xo$Kob5L7gVB$1wxmbI8&^@IbZ=@?+dM&jwb8oN3(AVqCuMat-svWj4bY-CPLEIuDaAQK)E6zC& zBt~a@ac)O?=0{LCLMUP%m2P#bA^Bkq-RRV7B`b)4)dt&n12#3dSH)4b=Dxf6UDYEdOd9&jGODvkrETo| zsJA7EYPB*-KF~1A=Zm;KA8UV2nU&jOguw07%h#(#wRk3}+Tk)@EM8EwXQzgt;kYsn zOBv<%sZIM1Sx}T;jX*h_T6f;z7S@OM>bTgCGOZTJZJy5_n-DuKlob{58jeNm>~-GG z@AT)^BD)+vu1@_F<3z5$Ph`f4G8HCujQ%rX;2ZJ-EysILxs8A_H4>&KebcplOprm z-%91spW!55>BB*lb>)Zmcm94*~t>O0cPIw!)$UWSNRCQarZS ze(F+&EYFQc9uK6`*tB^k#KTg%QXgPB$ygfgi}JNV%=%`B&+-y)W%RtD=5Ps+`T06b znvM|9jNaC!V$uG7WT{v-r&Mw*9(1My+faFjqKNIe-9W3+cs^bXrd%NnW+b_st26AL zSe1C^!DkJGlGgd){jB3G8+y(ByQkoqda5^c-%|9$qB~6B&vO#t%!BQ%-S%fKPP_Xk zXA~`JP<~q?%HxcNOKU$6M3@>KzQgT% zaVO$xrq%m+L4!_0VE*sl?rokwXMq>Z)^7h;?&wVxI64l4;|IfpI|a(k-_e z@s#SAJ+{InA9eONb=E&C=yAh^!I>RLD6lE;%j?Y1oElvRzY$f^JYNK+QUX=yVZ$C))O%;{Y+$V4hNhK^-C47cf+#srl3nm&nW7_1mIF+^T`-^G2hJA z9usplJh2H(?yVTGVFz2@35=iS4`>>`ZVuveHAe> zSuru238ATR+t@EoUzy|cMalvV83#kz5qz=Ya}tuIq(0kpWng>M?w)sr$azQBW}s~m zGL{Pw6j*TDq326?R4v9}NeHO#$}~~Yhi@?#B)sw{Q&QebdeFDX(-~X|CQC(hSA-4y z?mn&a7QSwmS1iqVfAckouz7OTER-AwY!aF`u2*qhyDN;EZDB{quXME(K~C)wt1ozxxx`hnnr7r*wG@M7dT^;3ccvh%QBsJ zxJS|`<***Q@a;|?5Mv{_ajulHu+8Uy{ca@}rOndPa$MqExp5p0j;roMWE)D7M}-nEOF-xvHbhRD^t0n}ATtBU8Y=fbJ%dVlIm=l;&3V}Q*Y*Bv+V z%HN@+4|!W!+2elR9;`CSpVWYdjHzS92xpl`x#U_MSvKi#{-)Tr-LkR;9bhZVQl-P9 zljz!Ga2X0-uhlF^6{2t3i(vQHJK8Sv8jsqucUjKHf*7l)K82C_zAu~>9}MjVlF$t9 zlw+8PGxh!boS2X0q3!vsP8GnD5k z1)|C#$q53ib}j{>AV7@h^PO`R?z7 ze}4A$AAj$^`OfEu-v+avJMIE7`}6{mv4xUAg_P z7v(jWS6Ww#bh$e8^+`|a>POMtHBIpdKa4z;XXoNa*gn*n_?Eh=V@*f+jZYQ=1ikbAFTj4ZlPnsYn4fiB3k@Kj`pn>qpwI?HCW z$_6dG5$Z(kxQ4ub!ZI5-%9Xe%z!3g^yB*5y*2HHP8nj97%k99Uq;6B#R6w zU`)U%Qp4P73tdBO&$s~5X!YSO{b3y}zOod5f!xb3-=rZbPpfkQs|PSYUm6I~??$OB3#!W|gRdE2ATF5lw-^ zc^gd)^1==4UZI*OS-F~sgG@=aJQeD_shr)-C<8TPyfi|&EmLhpp2P0mqXj1V-gDfOdLK2YP$;#k-( z8rAgi2=>0HBc`hFbQ1QDI5ncYR;80u-gPzF2Xn4Up@*70=m*Wh{Q7zljc;OwL3;V% z*YNd~r~PxMH&(MoFUI-D;=!w>h^(N^7G@UjBJ-{}pyUMu2C)xWq7+`1D3YTYoaQCT zWC;Oh2wi3{KrK4K$dZOrG$Avh#8V8*QJf)*pZ@4K|0Hnz947t+xPG_$0$ghQ4RFz> zn!U5kU<#7bzH)3_EmE<}{+ zHTd&`JHitd$05M`rZ?_PrVn^+VraPPGCq&Ij|A_C8eqb&{C8(;Cf6lkAFhjZKaaY9 zXDG(si#Ed~=d~9*FRoPDyYl=V3-_2s@e#!kKNz9FU)Zvsj-v=vrM{hkt2xB&{qYAS zyHv|TlAxK2kMt=C*~`>o#e7oYQ3KeTUhoPlS4=9d&*{+^v19lR`MmS6YPikQ8|8xJ zNIdBn4XyYTfyt|6`Hm{PYK-rBpa8qdB)!t zUMx?MvyAiV?oF#mc>ZSI&tlOzHA$b(%Xt|(crW<7kEG%5oM8#((Q={M@#VmqqvdcE zE7}E?paqJFi`ZmMPv_brzBnH8#w4qjO!m>fuQi!I9-8aFwVM4*(PN}nMzxE%Xh->F zFt|}gPuun$i7<&0;7(pTOvG?oOszrBb$63x(AqU}%5fn0ZjN>seGfE3?n>9uTaV#S z`o)*cTiG@o5$n<>p%HM)g9(6W(eS5l(hGMe(w!TtPoi^gaMC!Aly?kzlQ3v~_~eq1 z_N*TQ9edIlQOR2QYPl(<{o;)1T=`P+Wh5n?HB2j(-pA_{dk9g3|7}-tDlGiUCtFhu z9>1#>?Rvqy>GD)g&TG^a!tT0t-RokH#rY%jRhg_TXn}UDG?skTd;Ts3tY?9t`WAJ^ z+!DJv4q<8>>4a<}F~{$9D5}WnI~8SRPiiA)^hX->$W*+r$>?X-L3pKfv}RCH8-*tP8B~t(a563W?CIEy{B!iJzf&TPIf9~7B z_4&CX;TPokOVStQ647svixEk#nO)69G^xB;QbUM+k4Lh+Fj z)ABKsRg>CR$-u&XQ(n_%-j7SDgPx<_v>sm^?z4-J0YY$YvH6}PZN{WfcM?cyxdn3( zWCq)!QqA_nDq|{lCqci_>3O)dgU?7sCQ4GkJc0*wQ*Ry~hoi1kJfGEG^+q|kGAG`j z806HGEymUJOCtVz)1TdCM}X(G@$&gftkKr^DbFhBJK+WOYqVyhmk*gQqMEgZR;~=ip4T9+PM5>+b03 z>nXeQ42gL*yo#L)o#X@r_)_g8IJJCv*P7B~>PA$I=SaEl2Lh&;9;vV7`@?a)Ne`hR zxp;bgWjRN&>)R6GZfn($xdAHRU(mDRuml>^SYxx2L!ZVS!z1^0ZQ%+mV*SdWl!4?% zK@}?6ZlO%wtR&m2+iNG%a>SY7xN>V^D^*(hsajEQTk$+tBgXABD~?`fPU(=GnLqa^ zMbaUna9$Uc*l`e1XYH4o4szF#&}8x+4bvB1!~?aZMvjo`HE}Jh2zJj?pO|pps>@NY z8#*oxzBZ}M(|29A5+52ScwtLU;pFp{V(77{KmJ@3;B5-#uxCC|H&`l_4PmT4R}F(TDd^GN9ZR< z`Y*`X-^Nr*-CV3An@dL98q^YxVR;>tM|r1qvanQ$K(1jG*$G2@2=!H=zRLh;SntyH`py#Iez^s1uQ2ByqB}x@V45sXsq^tHo|u+8|RPjPGpS zt!^CN96}nM4pFo^;VooreV3Dk7I%~0o9As5sf(B1T@FUx*Es&PFK~^O>GQT#6*jc7 zz3xP3j~MSYQ@mpwi(KxM0cM0*N7!hwiHNn-_}nGCS^8>1oQ=JQNoRFbZ|nq5!DhG$ z@{4u#epbtK2Br{F!<~QKWEYJ30MtslE-FaTUP1y-AM#ENJ3+qENd>SxpivqpZbDTm zQmPQO+mq*}+HD=YW8QeM!ns2ouZ}@(@pSZ=uNRay^&fi+UJ>J)* zk3zCjS-8*kOUat$gsUH#eLm0Y%FQBT5%;$+!`86Vc-t^ngrd#7EFYJ+0F3^vkv^dZ z3%l%xh5F3E4G^a1Zgm8Ahwj7O?Qf!WNNnWL52u}6vC-V=0sM%UyzJup7DPIl2A8Zj z;$wV{-i_td$H%x)zL9o?J)BAdiDA}d;(BsCYCEs;iXi85*(d=$)b;Ty4S54_{(NNn zI>t7OG4KKO$LBqP2#rvvQRua&Pred=81D`F7~cJ4IPZt$ZO(Nnc^z$}TfL{c@^}e| zii=SG>3wBDdD`c@q2+IWIxF&BLZJZ<5Eu1Y2RaWO3ZL?p_Vrt2%}#cu$oAmdWkDWU zYXS+^8#d7BswZSz)qcD#w?W#@(pZzpSJt;2XvJzr(}l$uWI34KE!wl75vpY19R5%! zNz)~Rk`zTGSPt|qI8DK`l0q<&05DaS1zs>&iqbfW6ZhJa@aIIbzq*Tm`RaTOk2D{1KT>^G8b$OSq ze1~cqw)X9byB)D+L`P$n_0vq=_(%^hQyW|-f_Wz3=tW({$x;}9UNoDf7%rmKQ18?UENy%?nsFD>;+a#=!K=g! z1#s-81mP_}$CAQxag1EKw3y;ITIM{D&LKC|qRbfDdgM!lZYzsFao}E5f2eAJV2gLlYC_o%E6G z)5`|7@_mIKVGX@5g%afOSRB`}tGbS&Zx+HA>_eP4V@2nPws{~YG- zaxMn0s8yKqJ-Zdq88^j)66b?8?w(o~zR?e0MNa@*p=_7*I70d-0^1(YH;R_2yCVm+ zYp0$G)rpDCr$KvDM7}SA7v5^0$^F~7OPClU<<%?X(}rSsk9zrHW7!&ZG-a5P6H%1r zBG+m(-_IFu{8ZVR;6c~&uqGCaeW^o_2vBzgM zd6mQG3V8=L?j#`D7`4)@g5azH6fTfdeq7w~v+87}MmS0R^&r4Zrx#uA9JVg!s6-IS ze5tsN%1azSY>qB-pi|@|MZgHqL=q|k?2ti{;)}b;WDJ3UDJw-NG{=b|qlm055#Tn0 zkqp5SfO9|n(XV|QxIV}}|9_(&Uy$pc!oMKbcYpW|a?$>*jKjlMVIsWkr_m;?PFK(D zR(d|d+g*Tw`NWeB7P#1zPp(qt-FS3i0?@~=D{lAmY3bGW+ONbmVr|{+RsMm-q$=+| z#$0Q}4=9Q1FMw)Zo@20+RP8C1{&~#LBwBLgxd?A%Hp!dW>&ugT6fidu-ydE>Zj@$5tnWo8fgI~sj@Lts>I7d$%I@0!wONTyON zpcwkSetQ&74BM-{Rj4vnG*#V>oMoWNeZJ4i6)E69Z}QyVp~|kq7Nyf#P@!iBE}!ze z2m2!dB7u&s%|no|fimbcZX98C-gTf-bo<~T@q-s2C4obgv$mbrrPjmrwlhs?(XmDB zGMzRqG32B%#yVFo#wVGuKko12P2PMKwS!&=7!PiXF*^*;{;^h zZGqJ_=7~SzEb{hjkC>RQ?Ao_w9#{OMizpC5hvh9g>FGbZTd>%A+ZW?`i9}$``A?(> zA8)>1Z%&|_!b0H~_j)>6e^Bs*ZzaoW8CcrhfLf+)_XIzCez{7o9>kRoq$;s+H*e9X;BBZ zc=KHB+B|#4#=4`HIvIBl=LKRjMPP-YignRSboIcUzG^k%OtpiF@-y%V?FJp^Q|iP+ zVNhKXm^1?;^0jk5cv2}P)yy~{)7u&t&T(w@?H1z7;rCv&x5ye6@w*|FU;}}k=l&85 z3fZAJPjbO8-|V$!0?{o`%)xXHop75iZYCsi@7H5yor9+Qa9+7Mxzsrn9FT=u)5T|+ z2*q;1B0pyM>Pvgs5Fc<8_#SrIJDu;stIT!4io-<;3meLq4VdWRh>uSK&zwhkAw*TY z4wo#63@$`j;w z7y>3Rk}MOP$w?3sLlc}X0k#3T9;78eqN0Go_*I}Z_V@VW55A3F$o?gn_Wuf|eF3ju z>j8NEYya)HWO`-=o09Qy*3Ifp&ccg)NKb-+WwssD4q807?{HVw3rps#$~^0$n!m|^C=%1gA1X#~TH}V6p zg@}g3s1iQu;47Ctt6t(VMYzAh@5{&nS#<@B5u!46S8QF)A&JRYgUQpFbSR_;Jl7yWW;#2jU}xgKIfCV3-!bK z_;gxndFO!6v-C*O_U2Tj8Ya-%`P!2esW)jaOo_FOXxcJaah6LUQ`^T*Z5BQGQnF63 z#mvGz-o-ZVNVw;lS}&qpbIug|Gcy~cvhd2bcq2uLd|h0x#h6Gg`236PtL&%t70^tz zOT9qVjvRDpx*d(qcl5yOh9y<@Y>iyI19Mvk6ei+~RL*n?cu_;RG|RA| z*c*fy?&r)dM#=9m+Mi4wy)MHi08=V~{R#a>s^ell_& zCP$=}%f)#mBo6F21HE;x^Gf@j@Ap1gxI$FVCPA4J%7rgzXWKgCBuB)kK8>T00}Os2d#KoJw&s9Z5DXy#5s*s%#O(zCVs#|ws7J>JI` z@GQ*8Wi{J@l+r{9s|LM39P}ONvG#|Zpbj@)whY`*+PvbIk$)vxd+jbg+?Kak#bZ-F zE$W`!^}DlU@9x|)mnUWbK=O2b5{u|q{qALX1jKp98}C%5tru;NY6+FDkQ-aF6p$WF zg1nt$g>uEd`4LCZEGcOM0rNVUB_OFoAwbJYaDZMU#*_%~71KOLzeK)pkOTW-EHVj| zVmL;W2})r<{n4-fN#Oc9nb|ME^^g5aUx4es`WL^Mx}asSycX%YifZBg(@%T{Am(1A zklA2yBjSbO7S7#iobs9R!e(algYt(bq8@GtvU93)0kI%mA=oytgy{`24zy2l$F7Qm zbV)DPA-p2I7q4sUJBM@w6NwMw$B5!j15?g%duYj-32KvsNcZ7qHr=~K<5607`P>O! z)G~(y3Hfj=9i-EQcGV2QMc@W!%pch@9Tzw7Kx`stz5J;++MT=s%*L&5bN8)NFn%Y=JPax zK$k1l#cgjz$f0<$#ucZMg~aaQ7ZVHV@b?kccv9gVkgn-~?qrG4=tGOD@MmzatbTa`#asl|XZix9s^b4Wwb344(Q~`xRH% zRVR4+De%@!3&P&1w0r$o1dF_%MzMjdo|Kc&M?rsmS6U`Xp05Q~F{kP6y5*`bdav*q zcB1i$TR!%#tn#eigWQ1O09>Agjs|6NjSd;k3^}z9Akm}w4CvmbxaW?_r?EiyTS$}s zt;!Fwb;bU@YM+NE7(&e}xdxmE_;_^cKL+V<>imBssd8<4GP z6ythdp87jb-n+A}%4s54l=<=-Wy_tYwY3O3pffJHXBXfeu2bZ=QF% zpbps&U;)UO`sD+cCAD66w=d1Oe@H2$S$ncF|gBb5H*AGU& z>A<9t-KA~h)@Gr*5k^20VFTibJ0l%7LVLggFW3UIyb_||GD#DVdZH+pq8U5|c}tqg zFcKpuCIM8EA^}6p2@nATRFTHW93&c!@(Ei z`p>;@kn1uh_(-J>Hoi(7;xTTpytJWVS=9%pb77CAs?4B8<5Rpwb#d6EG#2T|GnE#c z6MDjuH9`bBJyL+@c z5jaJuy?~!X0Q0tiYWC5HE|xa}fmCeM_m;90W9~|;2rg<$f-qKpYN)E(8HK(GX`=YN z5=XEH(}k(F3VDwom1PdDD$;lo9xzCLy0;9ecg5KrrEXAOtXbskF%>Upzn%woEy-E zG*loPQ79z})M9l(YApkd^@O+=5jE9!%c-4a5Oy$uaf2Wc?Y@|psQB$IP|=B6ic(cS zcd;3bt7p{29d^b12CTh0Xto8C|=c@+f=mz=8$6V271D8+_ZiSA0=|w z>8{W%6h$o-4HlKJfNW)27!f$C6CVo!X_^>SE)=WE zN8Do!xygplv$HdUcqWkQN>v7SY83Z~Qti+Kd!DG`0zFf5OAKXFk|U^Ey<^zJaHG4! zCK}8g0YkQ;nGgD{5zU=UG)YT;{7|kHEi;(8(T^?a@wPj`)PxO zb&TBwe0XvR*0m;~<1FwfP7ria4MJ8?0cbRGCAuGr6>|t%P32G%(Bw|t$UFiCZb)~v z$ahy9dVkTc&)~wr?vV*%v2K@c0C8;A=Eg1#agVL~>kXDA@R5m+0+DEcgi-gLCJsd3 zG`e2fUO6$EOfZ5-X$k{3TxA)|FgT88HHhLlZ&$->`3wZtV|M&&G{*(XW8}MRUy3oJXHXZxB ztuv}zTlCwx-R71Af?9=HPLJ>+xZx^%PHotQWx$dAuD7iKvmX+}=ITJ5uA4npSJYv2 zx4x-`gwm?p;}N0RG?U50Hy^L3Y1$9b>fTLSNvOG;)_Xz98&9S#N4q|qhv5kWnDl|k z;qWpH6bCz?bfPoC?K-{b@os2RRIdFlj412JOjmU}`wW+5)Omk)I zrM7_Qsy7=C`0%JfJk+9=9JpjNUiY7o6;AbyAik(<#rY;*JEI- zcV@hXL3MQ#L5cSM~(Qi=1{D{2TNZ2L;d?X#dHAT<{bcTVt4GFrvw)67P$FZsg)aZJz&I+q(! zF}M?ZV3f`?ofzvQ9Of+mIVb#Dql6}_k?nv4o;HX9xY?{Rh$ND4{K1QAb>?-W@`UbM z;9Ki!kJ#);V+?v1?6K$6cp(Eiflc(vJV@$s8^@Y`t;m9h7Q^Y4h-u=0i4PuNuX=cR zL3EN?T|b8|0lmzn#1~JwHwHUma7W}ppJRBTn&1U2+fIf}Fr?ki9d%{4UoH4b5*H;km%NO(ODqFH9EW$?&UDwd84<7bDAEgY&{m}v`^^AMD)Sl!x?g9{jla*>8pFB{K z)94tUXR|ha!KU+o2`~c|X4BE~U&Ua4q#Kc%3Q=cCZ%(H%JzaGvClmzDaggfu@4P-tmYQ9n@U) zK5t|s>J4av+OThOq7tr~M#qwjD!^uq5ikc>zmWhd2WzF%*Sw6%Kx=61(JDJjK_yrm zQ-i^VfXn6fOpQmPswbj_)bMBt$C;k#>jwOhK`&|FE@(06fzgtXQ4yG7^d@A!a3LPX zfE5q`5y)Zjur%dimVIFeqkzza>gn7(a?zHlbOFfI< D{&$q! diff --git a/server/server.ts b/server/server.ts index b436b42..552569c 100644 --- a/server/server.ts +++ b/server/server.ts @@ -24,9 +24,8 @@ if (process.env.ENVIRONMENT == "dev") { // Apply rate limiting const postLimiter = rateLimit({ - windowMs: 5000, // 1 day - // windowMs: 1000 * 60 * 60 * 24, // 1 day - max: 1, // Limit each IP to 50 requests per window + windowMs: parseInt(process.env.POST_LIMIT_WINDOW_SECONDS as string) * 1000, + max: parseInt(process.env.POST_LIMIT as string), // Limit each IP to X requests per window standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers legacyHeaders: false, // Disable the `X-RateLimit-*` headers });