From 569384038ae0327365e2d9f5f9ccf6b80d2ddca1 Mon Sep 17 00:00:00 2001 From: Andres Date: Sun, 15 Oct 2023 18:12:17 +0200 Subject: [PATCH] feat: rate-limiter --- README.md | 2 ++ backend/routes/auth.js | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 59e9513..ceed218 100755 --- a/README.md +++ b/README.md @@ -168,6 +168,8 @@ Advanced manual setups are also supported. Check the following environment varia | ZU_DISABLE_AUTH | unset | If set to true, automatically log in all users. This is useful if ZeroUI is protected by an authentication proxy. Note that when this value is changed, the localStorage of instances of logged-in panels should be cleared | | ZU_LAST_SEEN_FETCH | `true`| Enables [Last Seen feature](https://github.com/dec0dOS/zero-ui/issues/40) | | ZU_LAST_SEEN_SCHEDULE | `*/5 * * * *` | Last Seen cron-like schedule | +| ZT_BAN_TIME | 30 | The duration of the user's ban. (in minutes). You should write it on `environment` zerotier service | +| ZT_TRIES_TO_BAN | 50 | User/password combination attemps before ban. You should write it on `environment` zerotier service | ZeroUI could be deployed as a regular nodejs web application, but it requires a ZeroTier controller that is installed with the `zerotier-one` package. For more info about the network controller, you could read [here](https://github.com/zerotier/ZeroTierOne/tree/master/controller/#readme). diff --git a/backend/routes/auth.js b/backend/routes/auth.js index 3712878..7cc1a80 100644 --- a/backend/routes/auth.js +++ b/backend/routes/auth.js @@ -5,8 +5,8 @@ const router = express.Router(); import * as auth from "../services/auth.js"; const loginLimiter = rateLimit({ - windowMs: 15 * 60 * 1000, // 15 minutes - max: 5, // limit each IP to 5 requests per windowMs + windowMs: (Number(process.env.ZT_BAN_TIME) || 30) * 60 * 1000, // 30 minutes + max: Number(process.env.ZT_TRIES_TO_BAN) || 50, // limit each IP to 50 requests per windowMs message: { status: 429, error: "Too many login attempts, please try again in 15 minutes.",