如何在Node js中使用express-rate-limit进行速率限制后增加阻塞时间？

Question

The express-rate-limit library will block connections from a client (let's say identified by IP) after surpassing certain amount of requests per time unit. It also blocks the connections for a time equivalent to the time unit.

So, if it is set to block connections after 120 requests per minute; it will also block the IP for a minute. How could I extend the blocking time?

Here is my current example:

...

var express = require('express');
var app = express();

const RateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis');

limiter = new RateLimit({
  store: new RedisStore({
    expiry: 60
  }),
  max: 120
});

app.use(limiter);
...

Here, I am also using rate-limit-redis , its expiry parameter overwrites the windowMs parameter of express-rate-limit .

Answer 1

By using onLimitReached callback, you can keep a record of the time in which the IP is unblocked again. Then, you can write another middleware that checks when the unblocking date is reached.

In the example below, bannedIPs keeps the record of the time in which the IP is unblocked again, and banner is the middleware that uses the time to block the IP according to the current date.

...

var express = require('express');
var app = express();

const RateLimit = require('express-rate-limit');
const RedisStore = require('rate-limit-redis');

// Keep the IPs that are banned
const bannedIPs = {};

limiter = new RateLimit({
  store: new RedisStore({
    expiry: 60
  }),
  onLimitReached: function(req, res, options) {

    // The IP will be unblocked again in an hour (60*60*1000)
    bannedIPs[req.ip] = +new Date() + 60*60*1000;

  },
  max: 120
});

banner = function(req, res, next) {
  // If the current Date is still before than the unblocking date, 
  // send a 429 message indicating too many requests
  if (bannedIPs[req.ip] >= +new Date()) {
    res.status(429).send("Sorry, too many requests: " + new Date(bannedIPs[req.ip]));
  } else {
    next();
  }
}

app.use(banner);
app.use(limiter);
...

There is a lot of space of improvement, eg removing the IPs once they are no longer blocked, and maybe store the keys in Redis so they are persistent after restarting the server. But, this will give you a starting point.