add rate limiting

server/src/app.js

@@ -8,11 +8,13 @@ import languageMiddleware from "./middleware/languageMiddleware.js";
 import swaggerUi from "swagger-ui-express";
 import { handleErrors } from "./middleware/handleErrors.js";
 import { setupRoutes } from "./config/routes.js";
+import { generalApiLimiter } from "./middleware/rateLimiter.js";
+
 export const createApp = ({ services, controllers, appSettings, frontendPath, openApiSpec }) => {
 	const allowedOrigin = appSettings.clientHost;
 
 	const app = express();
-
+	app.use(generalApiLimiter);
 	// Static files
 	app.use(express.static(frontendPath));
 

server/src/config/routes.js

@@ -1,4 +1,5 @@
 import { verifyJWT } from "../middleware/verifyJWT.js";
+import { authApiLimiter } from "../middleware/rateLimiter.js";
 
 import AuthRoutes from "../routes/authRoute.js";
 import InviteRoutes from "../routes/inviteRoute.js";
@@ -25,7 +26,7 @@ export const setupRoutes = (app, controllers) => {
 	const notificationRoutes = new NotificationRoutes(controllers.notificationController);
 	const diagnosticRoutes = new DiagnosticRoutes(controllers.diagnosticController);
 
-	app.use("/api/v1/auth", authRoutes.getRouter());
+	app.use("/api/v1/auth", authApiLimiter, authRoutes.getRouter());
 	app.use("/api/v1/monitors", verifyJWT, monitorRoutes.getRouter());
 	app.use("/api/v1/settings", verifyJWT, settingsRoutes.getRouter());
 	app.use("/api/v1/checks", verifyJWT, checkRoutes.getRouter());

server/src/middleware/rateLimiter.js

@@ -0,0 +1,17 @@
+import rateLimit from "express-rate-limit";
+
+export const generalApiLimiter = rateLimit({
+	window: 60 * 1000,
+	limit: 600,
+	standardHeaders: true,
+	legacyHeaders: false,
+	ipv6Subnet: 64,
+});
+
+export const authApiLimiter = rateLimit({
+	window: 60 * 1000,
+	limit: 5,
+	standardHeaders: true,
+	legacyHeaders: false,
+	ipv6Subnet: 64,
+});