Add in rate limit to opening projets

This commit is contained in:
James Allen 2015-02-04 15:05:26 +00:00
parent 42d8f1f222
commit 4235c90623
3 changed files with 126 additions and 1 deletions

View file

@ -0,0 +1,37 @@
RateLimiter = require "../../infrastructure/RateLimiter"
module.exports = RateLimiterMiddlewear =
###
Do not allow more than opts.maxRequests from a single client in
opts.timeInterval. Pass an array of opts.params to segment this based on
parameters in the request URL, e.g.:
app.get "/project/:project_id", RateLimiterMiddlewear.rateLimit(endpointName: "open-editor", params: ["project_id"])
will rate limit each project_id separately.
Unique clients are identified by user_id if logged in, and IP address if not.
###
rateLimit: (opts) ->
return (req, res, next) ->
if req.session.user?
user_id = req.session.user._id
else
user_id = req.ip
params = (opts.params or []).map (p) -> req.params[p]
params.push user_id
if !opts.endpointName?
throw new Error("no endpointName provided")
RateLimiter.addCount {
endpointName: opts.endpointName
timeInterval: opts.timeInterval or 60
subjectName: params.join(":")
throttle: opts.maxRequests or 6
}, (error, canContinue)->
return next(error) if error?
if canContinue
next()
else
res.status(429) # Too many requests
res.write("Rate limit reached, please try again later")
res.end()

View file

@ -38,6 +38,7 @@ ConnectedUsersController = require("./Features/ConnectedUsers/ConnectedUsersCont
DropboxRouter = require "./Features/Dropbox/DropboxRouter"
dropboxHandler = require "./Features/Dropbox/DropboxHandler"
Modules = require "./infrastructure/Modules"
RateLimiterMiddlewear = require('./Features/Security/RateLimiterMiddlewear')
logger = require("logger-sharelatex")
_ = require("underscore")
@ -91,7 +92,12 @@ module.exports = class Router
app.get '/project', AuthenticationController.requireLogin(), ProjectController.projectListPage
app.post '/project/new', AuthenticationController.requireLogin(), ProjectController.newProject
app.get '/Project/:Project_id', SecurityManager.requestCanAccessProject, ProjectController.loadEditor
app.get '/Project/:Project_id', RateLimiterMiddlewear.rateLimit({
endpointName: "open-project"
params: ["Project_id"]
maxRequests: 10
timeInterval: 60
}), SecurityManager.requestCanAccessProject, ProjectController.loadEditor
app.get '/Project/:Project_id/file/:File_id', SecurityManager.requestCanAccessProject, FileStoreController.getFile
app.post '/project/:Project_id/settings', SecurityManager.requestCanModifyProject, ProjectController.updateProjectSettings

View file

@ -0,0 +1,82 @@
SandboxedModule = require('sandboxed-module')
sinon = require('sinon')
require('chai').should()
modulePath = require('path').join __dirname, '../../../../app/js/Features/Security/RateLimiterMiddlewear'
describe "RateLimiterMiddlewear", ->
beforeEach ->
@RateLimiterMiddlewear = SandboxedModule.require modulePath, requires:
'../../infrastructure/RateLimiter' : @RateLimiter = {}
@req =
params: {}
session: {}
@res =
status: sinon.stub()
write: sinon.stub()
end: sinon.stub()
@next = sinon.stub()
describe "rateLimit", ->
beforeEach ->
@rateLimiter = @RateLimiterMiddlewear.rateLimit({
endpointName: "test-endpoint"
params: ["project_id", "doc_id"]
timeInterval: 42
maxRequests: 12
})
@req.params = {
project_id: @project_id = "project-id"
doc_id: @doc_id = "doc-id"
}
describe "when under the rate limit with logged in user", ->
beforeEach ->
@req.session.user = { _id: @user_id = "user-id" }
@RateLimiter.addCount = sinon.stub().callsArgWith(1, null, true)
@rateLimiter(@req, @res, @next)
it "should call the rate limiter backend with the user_id", ->
@RateLimiter.addCount
.calledWith({
endpointName: "test-endpoint"
timeInterval: 42
throttle: 12
subjectName: "#{@project_id}:#{@doc_id}:#{@user_id}"
})
.should.equal true
it "should pass on to next()", ->
@next.called.should.equal true
describe "when under the rate limit with anonymous user", ->
beforeEach ->
@req.ip = @ip = "1.2.3.4"
@RateLimiter.addCount = sinon.stub().callsArgWith(1, null, true)
@rateLimiter(@req, @res, @next)
it "should call the rate limiter backend with the ip address", ->
@RateLimiter.addCount
.calledWith({
endpointName: "test-endpoint"
timeInterval: 42
throttle: 12
subjectName: "#{@project_id}:#{@doc_id}:#{@ip}"
})
.should.equal true
it "should pass on to next()", ->
@next.called.should.equal true
describe "when over the rate limit", ->
beforeEach ->
@req.session.user = { _id: @user_id = "user-id" }
@RateLimiter.addCount = sinon.stub().callsArgWith(1, null, false)
@rateLimiter(@req, @res, @next)
it "should return a 429", ->
@res.status.calledWith(429).should.equal true
@res.end.called.should.equal true
it "should not continue", ->
@next.called.should.equal false