[英]How to integrate rate-limiter-flexible in existing node.js express setup?
I use node.js, passport and jwt bearer token to protect my routes.我使用 node.js、passport 和 jwt 不记名令牌来保护我的路线。 What I don't have yet is rate limiting and blocking of ip/user if too many false attempts.
如果错误尝试过多,我还没有进行速率限制和阻止 ip/user。 What's the best way to implement it for my setup?
为我的设置实现它的最佳方法是什么?
I want to give it a try with rate-limiter-flexible.我想尝试使用 rate-limiter-flexible。 But how can I integrate eg the Login Example from here: https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#login-endpoint-protection in my setup below?
但是我如何在下面的设置中集成例如登录示例: https : //github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#login-endpoint-protection ?
helpers/rateLimiter.js助手/rateLimiter.js
const express = require('express');
const redis = require('redis');
const { RateLimiterRedis } = require('rate-limiter-flexible');
/* What goes here? Example https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#login-endpoint-protection doesn't seem to apply */
Those are my routes:这些是我的路线:
routes/index.js路线/ index.js
const express = require('express');
const router = require('express-promise-router')();
const passport = require('passport');
const passLogin = passport.authenticate('local-login', { session: false, failWithError: true });
const { rateLimiter } = require('../helpers/rateLimiter');
...
router.route('/v1/login')
.post( rateLimiter, passLogin, function(err, req, res, next) {
return res.status(401).send({ status: 401, success: false })
}, controller.login );
router.route('/v1/abc/search')
.post( passJWT_ABC, function(err, req, res, next) {
return res.status(401).send({ status: 401, success: false })
}, controller.search );
You should export middleware in this case.在这种情况下,您应该导出中间件。
const express = require('express');
const redis = require('redis');
const { RateLimiterRedis } = require('rate-limiter-flexible');
async function loginRoute(req, res) {
// code from example https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#login-endpoint-protection
}
export default async (req, res, next) => {
try {
await loginRoute(req, res);
next();
} catch (err) {
res.status(500).end();
}
}
And then you should take care of how authorise()
, user.isLoggedIn
and user.exists
checks work with your application login approach.然后您应该注意
authorise()
、 user.isLoggedIn
和user.exists
检查如何与您的应用程序登录方法一起工作。
There is an example with passport-local, should be useful for you as well https://github.com/passport/express-4.x-local-example/blob/67e0f735fc6d2088d7aa9b8c4eb25bc0052653ec/server-secure.js有一个护照本地的例子,应该对你有用https://github.com/passport/express-4.x-local-example/blob/67e0f735fc6d2088d7aa9b8c4eb25bc0052653ec/server-secure.js
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.