feat: implement rate limiting to prevent brute-force attacks (#1210)

backend/Middlewares/rateLimit/authLimiter.js

@@ -0,0 +1,7 @@
+import { RateLimiterMemory } from 'rate-limiter-flexible'
+
+export const authLimiter = new RateLimiterMemory({
+    points: 5,
+    duration: 15 * 60,
+    blockDuration: 15 * 60,
+})

backend/Middlewares/rateLimit/generalLimiter.js

@@ -0,0 +1,7 @@
+import { RateLimiterMemory } from 'rate-limiter-flexible'
+
+export const generalLimiter = new RateLimiterMemory({
+    points: 100,
+    duration: 15 * 60,
+    blockDuration: 5 * 60
+})

backend/Middlewares/rateLimit/index.js

@@ -0,0 +1,10 @@
+import { authLimiter } from './authLimiter.js'
+import { generalLimiter } from './generalLimiter.js';
+
+export const authMiddleware = (req, res, next) => {
+    authLimiter.consume(req.ip).then(() => next()).catch(() => res.status(429).send("Too many requests to /auth"));
+}
+
+export const generalMiddleware = (req, res, next) => {
+    generalLimiter.consume(req.ip).then(() => next()).catch(() => res.status(429).send("Too many requests"));
+}

backend/Routes/index.js

@@ -1,22 +1,26 @@
 import express from 'express';
 import authRoutes from './api/auth.routes.js';
+import userRoutes from './api/user.routes.js';
 import mediaRoutes from './api/media.routes.js';
 import projectRoutes from './api/project.routes.js';
-import userRoutes from './api/user.routes.js';
 import notificationRoutes from './api/notification.routes.js';
 import subscriberRoutes from './api/subscriber.routes.js';
 import collectionRoutes from './api/collections.routes.js';
 import collaborationRoutes from './api/collaboration.routes.js';
 
+import { authMiddleware, generalMiddleware } from '../Middlewares/rateLimit/index.js';
 
 const router = express.Router();
 
-router.use('/auth', authRoutes);
-router.use('/user', userRoutes);
-router.use('/media', mediaRoutes);
-router.use('/project', projectRoutes);
-router.use('/notification', notificationRoutes);
-router.use('/subscriber', subscriberRoutes);
-router.use("/collection", collectionRoutes);
-router.use('/collaboration', collaborationRoutes);
+
+router.use('/auth', authMiddleware, authRoutes);
+
+router.use('/user', generalMiddleware, userRoutes);
+router.use('/media', generalMiddleware, mediaRoutes);
+router.use('/project', generalMiddleware, projectRoutes);
+router.use('/notification', generalMiddleware, notificationRoutes);
+router.use('/subscriber', generalMiddleware, subscriberRoutes);
+router.use('/collection', generalMiddleware, collectionRoutes);
+router.use('/collaboration', generalMiddleware, collaborationRoutes);
+
 export default router;