john-okeefe
39f1c88255
One shared 100 req / 10 min limiter counted everything — 401s, CORS preflights, even /health — so a bad-token burst from a second frontend burned the budget and 429'd POST /api/auth/login too, leaving no way back in short of waiting out the window or restarting (MemoryStore reset). New middleware/rateLimit.js holds two limiters, verified against express-rate-limit@5.5.1: - apiLimiter (300 / 15 min) skips OPTIONS, /health, and the public auth endpoints, so preflights, probes, and login attempts never drain real API budget. - authLimiter (20 / 15 min, successful logins free) guards register/login/forgotpassword/resetpassword against brute force. 429 there means 20 wrong passwords, never a busy API. Storm-tested with live server: 320 bad-token hits burn the global budget yet login still returns 200; 25 bad logins trip only the login limiter while API traffic is untouched.
19 lines
757 B
JavaScript
19 lines
757 B
JavaScript
// noinspection SpellCheckingInspection
|
|
|
|
import express from 'express'
|
|
const router = express.Router()
|
|
import { register, login, getMe, forgotPassword, resetPassword, updateDetails, updatePassword, logout } from '../controllers/auth.js'
|
|
import { protect } from '../middleware/auth.js'
|
|
import { authLimiter } from '../middleware/rateLimit.js'
|
|
|
|
router.post('/register', authLimiter, register)
|
|
router.post('/login', authLimiter, login)
|
|
router.get('/logout', logout)
|
|
router.get('/me', protect, getMe)
|
|
router.put('/updatedetails', protect, updateDetails)
|
|
router.post('/forgotpassword', authLimiter, forgotPassword)
|
|
router.put('/resetpassword/:resettoken', authLimiter, resetPassword)
|
|
router.put('/updatepassword', protect, updatePassword)
|
|
|
|
export default router
|