From e0fa63db0f8709fe8f680da97eedf30f338bf05c Mon Sep 17 00:00:00 2001
From: Takeshi Kimata <117462761+kimatata@users.noreply.github.com>
Date: Sat, 20 Jul 2024 08:40:45 +0900
Subject: [PATCH] feat: enable rate limit on API server (#15)

---
 backend/index.js          |  9 +++++++++
 backend/package-lock.json | 21 +++++++++++++++++++++
 backend/package.json      |  1 +
 3 files changed, 31 insertions(+)

diff --git a/backend/index.js b/backend/index.js
index 2a6a03d..5d303de 100644
--- a/backend/index.js
+++ b/backend/index.js
@@ -1,4 +1,5 @@
 const express = require('express');
+const RateLimit = require('express-rate-limit');
 const path = require('path');
 const { Sequelize } = require('sequelize');
 const app = express();
@@ -15,6 +16,14 @@ app.use(cors(corsOptions));
 // enable json middleware
 app.use(express.json());
 
+// enable rate limiter
+const limiter = RateLimit({
+  windowMs: 60 * 60 * 1000, // 1h
+  max: 1000, // 1000 requests per hour
+  message: 'Too many requests from this IP, please try again after an hour',
+});
+app.use(limiter);
+
 // Specify the directory to serve static files
 app.use(express.static(path.join(__dirname, 'public')));
 
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 32f1422..00c15a8 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -12,6 +12,7 @@
         "bcrypt": "^5.1.1",
         "cors": "^2.8.5",
         "express": "^4.18.2",
+        "express-rate-limit": "^7.3.1",
         "jsonwebtoken": "^9.0.2",
         "multer": "^1.4.5-lts.1",
         "sequelize": "^6.36.0",
@@ -1132,6 +1133,20 @@
         "node": ">= 0.10.0"
       }
     },
+    "node_modules/express-rate-limit": {
+      "version": "7.3.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-7.3.1.tgz",
+      "integrity": "sha512-BbaryvkY4wEgDqLgD18/NSy2lDO2jTuT9Y8c1Mpx0X63Yz0sYd5zN6KPe7UvpuSVvV33T6RaE1o1IVZQjHMYgw==",
+      "engines": {
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/express-rate-limit"
+      },
+      "peerDependencies": {
+        "express": "4 || 5 || ^5.0.0-beta.1"
+      }
+    },
     "node_modules/ext": {
       "version": "1.7.0",
       "resolved": "https://registry.npmjs.org/ext/-/ext-1.7.0.tgz",
@@ -4292,6 +4307,12 @@
         "vary": "~1.1.2"
       }
     },
+    "express-rate-limit": {
+      "version": "7.3.1",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-7.3.1.tgz",
+      "integrity": "sha512-BbaryvkY4wEgDqLgD18/NSy2lDO2jTuT9Y8c1Mpx0X63Yz0sYd5zN6KPe7UvpuSVvV33T6RaE1o1IVZQjHMYgw==",
+      "requires": {}
+    },
     "ext": {
       "version": "1.7.0",
       "resolved": "https://registry.npmjs.org/ext/-/ext-1.7.0.tgz",
diff --git a/backend/package.json b/backend/package.json
index 8486145..aa50781 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -14,6 +14,7 @@
     "bcrypt": "^5.1.1",
     "cors": "^2.8.5",
     "express": "^4.18.2",
+    "express-rate-limit": "^7.3.1",
     "jsonwebtoken": "^9.0.2",
     "multer": "^1.4.5-lts.1",
     "sequelize": "^6.36.0",